Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-5561

Date: October 16, 2023

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Language: PHP

Severity Score

Related Resources (6)

https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441
https://nvd.nist.gov/vuln/detail/CVE-2023-5561
https://security-tracker.debian.org/tracker/CVE-2023-5561
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/
https://www.mend.io/vulnerability-database/CVE-2023-5561

Severity Score

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us