CVE-2023-5561

Published: Oct 16, 2023Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Affected (17)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	From 4.7 to 4.7.27
Wordpress Wordpress	From 4.8 to 4.8.23
Wordpress Wordpress	From 4.9 to 4.9.24
Wordpress Wordpress	From 5.0 to 5.0.20
Wordpress Wordpress	From 5.1 to 5.1.17
Wordpress Wordpress	From 5.2 to 5.2.19
Wordpress Wordpress	From 5.3 to 5.3.16
Wordpress Wordpress	From 5.4 to 5.4.14
Wordpress Wordpress	From 5.5 to 5.5.13
Wordpress Wordpress	From 5.6 to 5.6.12
Wordpress Wordpress	From 5.7 to 5.7.10
Wordpress Wordpress	From 5.8 to 5.8.8
Wordpress Wordpress	From 5.9 to 5.9.8
Wordpress Wordpress	From 6.0 to 6.0.6
Wordpress Wordpress	From 6.1 to 6.1.4
Wordpress Wordpress	From 6.2 to 6.2.3
Wordpress Wordpress	From 6.3 to 6.3.2