BIT-wordpress-2023-5561

vendorUSosv

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

view advisory published 2024-03-06Licence: per source

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-5561US	medium5.3	4.33% (91st)	Exploit	2023-10-16
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have publishe…

references

External citations — patches, advisories, analysis.

https://lists.debian.org/debian-lts-announce/2023/11/msg00014.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-5561WEB
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/ADVISORY
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan