Unrated severityNVD Advisory· Published Oct 16, 2023· Updated Apr 23, 2025
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
CVE-2023-5561
Description
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Affected products
3- osv-coords2 versions
>= 4.7.0, < 4.7.27+ 1 more
- (no CPE)range: >= 4.7.0, < 4.7.27
- (no CPE)range: >= 4.7.0, < 4.7.27
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441mitreexploitvdb-entrytechnical-description
- wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/mitretechnical-description
- lists.debian.org/debian-lts-announce/2023/11/msg00014.htmlmitre
News mentions
0No linked articles in our index yet.