Description
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Active Directory Integration / LDAP Integration | < 4.1.10 | 4.1.10 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | owasp-modsecurity-crs | 4.10.0-1.1 | openSUSE-SU-2025:14717-1 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure http/cves/2023/CVE-2023-5003.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- openSUSE-SU-2025:14717-1 owasp-modsecurity-crs-4.10.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748 exploit vdb-entry technical-description