CVE-2023-5561

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

State: Published
Severity: 5.3 Medium
Published: Oct 16, 2023
Updated: Apr 23, 2025
Reserved: Oct 12, 2023

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
WordPressWordPress	6.3.0 to before 6.3.2Affected 6.2.0 to before 6.2.3Affected 6.1.0 to before 6.1.4Affected 6.0.0 to before 6.0.6Affected 5.9.0 to before 5.9.8Affected 5.8.0 to before 5.8.8Affected 5.7.0 to before 5.7.10Affected 5.6.0 to before 5.6.12Affected 5.5.0 to before 5.5.13Affected 5.4.0 to before 5.4.14Affected 5.3.0 to before 5.3.16Affected 5.2.0 to before 5.2.19Affected 5.0.0 to before 5.0.20Affected 4.9.0 to before 4.9.24Affected 4.8.0 to before 4.8.23Affected 4.7.0 to before 4.7.27Affected

Product

Versions

WordPressWordPress

6.3.0 to before 6.3.2Affected
6.2.0 to before 6.2.3Affected
6.1.0 to before 6.1.4Affected
6.0.0 to before 6.0.6Affected
5.9.0 to before 5.9.8Affected
5.8.0 to before 5.8.8Affected
5.7.0 to before 5.7.10Affected
5.6.0 to before 5.6.12Affected
5.5.0 to before 5.5.13Affected
5.4.0 to before 5.4.14Affected
5.3.0 to before 5.3.16Affected
5.2.0 to before 5.2.19Affected
5.0.0 to before 5.0.20Affected
4.9.0 to before 4.9.24Affected
4.8.0 to before 4.8.23Affected
4.7.0 to before 4.7.27Affected

References

https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441exploitvdb-entrytechnical-description
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/technical-description
https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.