CVE-2022-3907

Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure

The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.

Affected

Clerk

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.94% chance of exploitation in the next 30 days, 60th percentile

Published

2022-12-05

Updated

2025-04-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7920c1c1-709d-4b1f-ac08-f0a02ddb329c

References

• CVE Record
• NVD entry