Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-5561

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Published

2023-10-16T20:15:18.073

Last Modified

2025-04-23T17:16:50.853

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application wordpress wordpress < 4.7.27 Yes
Application wordpress wordpress < 4.8.23 Yes
Application wordpress wordpress < 4.9.24 Yes
Application wordpress wordpress < 5.0.20 Yes
Application wordpress wordpress < 5.1.17 Yes
Application wordpress wordpress < 5.2.19 Yes
Application wordpress wordpress < 5.3.16 Yes
Application wordpress wordpress < 5.4.14 Yes
Application wordpress wordpress < 5.5.13 Yes
Application wordpress wordpress < 5.6.12 Yes
Application wordpress wordpress < 5.7.10 Yes
Application wordpress wordpress < 5.8.8 Yes
Application wordpress wordpress < 5.9.8 Yes
Application wordpress wordpress < 6.0.6 Yes
Application wordpress wordpress < 6.1.4 Yes
Application wordpress wordpress < 6.2.3 Yes
Application wordpress wordpress < 6.3.2 Yes
References