Lucene search
Krzysztof ZającWPVDB-ID:91C44C45-994B-4AED-B9F9-7DB45924EEB4HistoryFeb 14, 2022 - 12:00 a.m.
Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure
2022-02-1400:00:00
Krzysztof Zając
wpscan.com
16
0.001 Low
EPSS
Percentile
21.6%
The plugin does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
PoC
Open the following URL as a subscriber: https://example.com/wp-admin/admin-ajax.php?action=vczapi_get_wp_users
| CPE | Name | Operator | Version |
|---|---|---|---|
| video-conferencing-with-zoom-api | lt | 3.8.17 |
Related
nvd
nvd
CVE-2022-0384
2022-03-07 09:15:09
cnvd
cnvd
WordPress Video Conferencing with Zoom Plugin信息泄露漏洞
2022-03-09 00:00:00
prion
prion
Design/Logic Flaw
2022-03-07 09:15:00
cve
cve
CVE-2022-0384
2022-03-07 09:15:09
wpexploit
wpexploit
Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure
2022-02-14 00:00:00
cvelist
cvelist