IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
5.3Media

CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

WordPress WordPress Publicada: (hace 3 años)

Descripción

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Debilidad (CWE): CWE-200

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
WordPress WordPress 6.3.0 – < 6.3.2, 6.2.0 – < 6.2.3, 6.1.0 – < 6.1.4, 6.0.0 – < 6.0.6, 5.9.0 – < 5.9.8, 5.8.0 – < 5.8.8, 5.7.0 – < 5.7.10, 5.6.0 – < 5.6.12, 5.5.0 – < 5.5.13, 5.4.0 – < 5.4.14, 5.3.0 – < 5.3.16, 5.2.0 – < 5.2.19, 5.0.0 – < 5.0.20, 4.9.0 – < 4.9.24, 4.8.0 – < 4.8.23, 4.7.0 – < 4.7.27

Referencias y parches

CVE recientes del mismo producto — WordPress (core)

8.1Alta
CVE-2026-87902 KEV

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS
8.8Alta
CVE-2026-65640
WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS
8.9Alta
CVE-2026-64638
WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…