IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

WordPress WordPress Yayım: (3 yıl önce)

Açıklama

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Zayıflık türü (CWE): CWE-200

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
WordPress WordPress 6.3.0 – < 6.3.2, 6.2.0 – < 6.2.3, 6.1.0 – < 6.1.4, 6.0.0 – < 6.0.6, 5.9.0 – < 5.9.8, 5.8.0 – < 5.8.8, 5.7.0 – < 5.7.10, 5.6.0 – < 5.6.12, 5.5.0 – < 5.5.13, 5.4.0 – < 5.4.14, 5.3.0 – < 5.3.16, 5.2.0 – < 5.2.19, 5.0.0 – < 5.0.20, 4.9.0 – < 4.9.24, 4.8.0 – < 4.8.23, 4.7.0 – < 4.7.27

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress (core)

8.1Yüksek
CVE-2026-87902 KEV

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS
8.8Yüksek
CVE-2026-65640
WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS
8.9Yüksek
CVE-2026-64638
WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…