CVE-2023-5561
CVE-2023-5561 · WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVSS 5.3 · Medium · EPSS 4.3% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
wordpress
- Versions
- ≥ 6.3.0, < 6.3.2: Affected (semver)
- ≥ 6.2.0, < 6.2.3: Affected (semver)
- ≥ 6.1.0, < 6.1.4: Affected (semver)
- ≥ 6.0.0, < 6.0.6: Affected (semver)
- ≥ 5.9.0, < 5.9.8: Affected (semver)
- ≥ 5.8.0, < 5.8.8: Affected (semver)
- ≥ 5.7.0, < 5.7.10: Affected (semver)
- ≥ 5.6.0, < 5.6.12: Affected (semver)
- ≥ 5.5.0, < 5.5.13: Affected (semver)
- ≥ 5.4.0, < 5.4.14: Affected (semver)
- ≥ 5.3.0, < 5.3.16: Affected (semver)
- ≥ 5.2.0, < 5.2.19: Affected (semver)
- ≥ 5.0.0, < 5.0.20: Affected (semver)
- ≥ 4.9.0, < 4.9.24: Affected (semver)
- ≥ 4.8.0, < 4.8.23: Affected (semver)
- ≥ 4.7.0, < 4.7.27: Affected (semver)
Update to 4.7.27; Update to 4.8.23; Update to 4.9.24; Update to 5.0.20; Update to 5.2.19; Update to 5.3.16; Update to 5.4.14; Update to 5.5.13; Update to 5.6.12; Update to 5.7.10; Update to 5.8.8; Update to 5.9.8; Update to 6.0.6; Update to 6.1.4; Update to 6.2.3; Update to 6.3.2
wordpress Debian:12
- Versions
- 6.1.1+dfsg1-1
- Affected ranges
- ECOSYSTEM: < 6.1.6+dfsg1-0+deb12u1
Update to 6.1.6+dfsg1-0+deb12u1
wordpress Debian:13
- Affected ranges
- ECOSYSTEM: < 6.3.2+dfsg1-1
Update to 6.3.2+dfsg1-1
wordpress Debian:14
- Affected ranges
- ECOSYSTEM: < 6.3.2+dfsg1-1
Update to 6.3.2+dfsg1-1
wordpress Ubuntu:16.04:LTS
- Versions
- 4.3+dfsg-1
- 4.3.1+dfsg-1
- 4.4+dfsg-1
- 4.4.1+dfsg-1
- 4.4.2+dfsg-1
- 4.4.2+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wordpress Ubuntu:18.04:LTS
- Versions
- 4.8.2+dfsg-2
- 4.8.3+dfsg-1
- 4.9.1+dfsg-1
- 4.9.2+dfsg-1
- 4.9.4+dfsg-1
- 4.9.5+dfsg1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wordpress Ubuntu:20.04:LTS
- Versions
- 5.2.2+dfsg1-1
- 5.2.4+dfsg1-1
- 5.3.2+dfsg1-1
- 5.3.2+dfsg1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wordpress Ubuntu:22.04:LTS
- Versions
- 5.7.1+dfsg1-2ubuntu1
- 5.8.1+dfsg1-2ubuntu1
- 5.8.2+dfsg1-1ubuntu1
- 5.8.3+dfsg1-1ubuntu1
- 5.8.3+dfsg1-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wordpress Ubuntu:24.04:LTS
- Versions
- 6.2+dfsg1-1ubuntu1
- 6.4.3+dfsg1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published