Authentication vulnerability in Staff / Employee Business Directory for Active Directory 1.2.3

The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to a security issue called LDAP Passback. This issue affects all versions up to and including 1.2.3. It occurs because the plugin does not properly validate when changing the LDAP server. This allows an attacker with administrative access to the website to change the LDAP server and collect the credentials from the original LDAP server.