cve/2023/CVE-2023-5003.md

### [CVE-2023-5003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5003)
![](https://img.shields.io/static/v1?label=Product&message=Active%20Directory%20Integration%20%2F%20LDAP%20Integration&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%204.1.10%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-538%20Insertion%20of%20Sensitive%20Information%20into%20Externally-Accessible%20File%20or%20Directory&color=brighgreen)

### Description

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.

### POC

#### Reference
- https://wpscan.com/vulnerability/91f4e500-71f3-4ef6-9cc7-24a7c12a5748

#### Github
No PoCs found on GitHub currently.