CVE-2022-4417: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-4417 affects the WP Cerber Security, Anti-spam & Malware Scan WordPress plugin versions before 9.3.3. The vulnerability was discovered and publicly disclosed on December 12, 2022, by security researcher Abdul Muneeb (WPScan, CVE Mitre).

The vulnerability stems from improper access control to the REST API users endpoint specifically when the WordPress blog is installed in a subdirectory. This occurs even when the 'Block access to users' data via REST API' setting is enabled in the plugin's security hardening section. The vulnerability can be exploited by accessing the endpoint at 'https://example.com/subdir//wp-json/wp/v2/users' (WPScan).

When successfully exploited, this vulnerability allows attackers to bypass the implemented restrictions and enumerate the website's users, potentially exposing user information that should have been protected (CVE Mitre).

The vulnerability has been fixed in version 9.3.3 of the WP Cerber Security plugin. Users are advised to update to this version or later to protect against this security issue (WPScan).