Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass
Priority HIGH 72CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00518 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Ldap WP Login / Active Directory Integration (Unknown): 3.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Ldap WP Login / Active Directory Integration | 3.0.2 to before 3.0.2 | 3.0.2 | Patch available | CNA |
- Ldap WP Login / Active Directory Integration VendorUnknown Affected 3.0.2 to before 3.0.2 Fixed in 3.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ldap_wp_login_\/_active_directory_integration_project:ldap_wp_login_\/_active_directory_integration:*:*:*:*:*:wordpress:*:* | before 3.0.2 | Vulnerable | Ldap Wp Login / Active Directory Integration Project |
- cpe:2.3:a:ldap_wp_login_\/_active_directory_integration_project:ldap_wp_login_\/_active_directory_integration:*:*:*:*:*:wordpress:*:* Versions before 3.0.2 Vulnerable ·Ldap Wp Login / Active Directory Integration Project
Remediation
- Fix · CNA Ldap WP Login / Active Directory Integration (Unknown) Fixed in 3.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2987
- 2026-10-03 Alias added: GHSA-mh2q-2wc7-4q2g
References
Sources
- CVE-2022-2987 · CVE Program
- CVE-2022-2987 · NVD
- FIRST EPSS
- GHSA-mh2q-2wc7-4q2g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences