What is the CVSS score of CVE-2023-4505?

CVE-2023-4505 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2023-4505?

Yes, a public proof-of-concept exploit is available for CVE-2023-4505. Prioritise patching immediately. EPSS: 0.5%.

Staff Employee Business Directory For Active Directory CVE-2023-4505

LOW

Missing Authentication for Critical Function (CWE-306)

2023-09-27 security@wordfence.com

WordPress Authentication Bypass Staff Employee Business Directory For Active Directory

2.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 17:17 vuln.today

Public exploit code

CVE Published

Sep 27, 2023 - 15:19 nvd

LOW 2.2

DescriptionCVE.org

The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.

AnalysisAI

The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server. Affected products include: Miniorange Staff \/ Employee Business Directory For Active Directory.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.