Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2023-5561

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WordPress WordPress

Default version status: unaffected

  • 6.3.0 to < 6.3.2affected
  • 6.2.0 to < 6.2.3affected
  • 6.1.0 to < 6.1.4affected
  • 6.0.0 to < 6.0.6affected
  • 5.9.0 to < 5.9.8affected
  • 5.8.0 to < 5.8.8affected
  • 5.7.0 to < 5.7.10affected
  • 5.6.0 to < 5.6.12affected
  • 5.5.0 to < 5.5.13affected
  • 5.4.0 to < 5.4.14affected
  • 5.3.0 to < 5.3.16affected
  • 5.2.0 to < 5.2.19affected
  • 5.0.0 to < 5.0.20affected
  • 4.9.0 to < 4.9.24affected
  • 4.8.0 to < 4.8.23affected
  • 4.7.0 to < 4.7.27affected

References