5.3Mittel

CVE-2023-5692WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

WordPress Foundation WordPress Veröffentlicht: 2024-04-05 15:52 (vor 2 Jahren)

Beschreibung

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.

Schwachstellentyp (CWE): CWE-200

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
WordPress Foundation	WordPress	≤ 6.4.3

Referenzen und Patches

CVSS-Score

5.3Mittel

Quelle: Wordfence · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Niedrig
Integrität: Keine
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.84%

höher als 58 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2023-10-20
Veröffentlicht2024-04-05 15:52
Bei IP-DB eingegangen2026-10-24 23:52
Zuletzt aktualisiert2026-04-08 19:59

Vergeben von (CNA): Wordfence

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress (core)

8.1Hoch

CVE-2026-119977 KEV vor 8 Tagen

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Foundation WordPress

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…

1.2%EPSS

4.9Mittel

CVE-2026-114570 vor 17 Tagen

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Foundation WordPress

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and ab…

8.1Hoch

CVE-2026-87902 KEV vor 1 Monat

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS

8.8Hoch

CVE-2026-65640 vor 2 Monaten

WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS

8.9Hoch

CVE-2026-64638 vor 3 Monaten

WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…

5.9Mittel

CVE-2026-60137 KEV vor 3 Monaten

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress WordPress

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

5.3%EPSS