Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-3907

Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure

Description

The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Clerk

Default version status: unaffected

  • 0 to < 4.0.0affected

References