WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.3.2, 6.2.3, 6.1.4, 6.0.6, 5.9.8, and 11 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- WordPress WordPress
From 6.3.0 · fixed in 6.3.2; From 6.2.0 · fixed in 6.2.3; From 6.1.0 · fixed in 6.1.4; From 6.0.0 · fixed in 6.0.6; From 5.9.0 · fixed in 5.9.8; From 5.8.0 · fixed in 5.8.8; From 5.7.0 · fixed in 5.7.10; From 5.6.0 · fixed in 5.6.12; From 5.5.0 · fixed in 5.5.13; From 5.4.0 · fixed in 5.4.14; From 5.3.0 · fixed in 5.3.16; From 5.2.0 · fixed in 5.2.19; From 5.0.0 · fixed in 5.0.20; From 4.9.0 · fixed in 4.9.24; From 4.8.0 · fixed in 4.8.23; From 4.7.0 · fixed in 4.7.27