CVE-2023-5692mediumCWE-200

CVE-2023-5692: medium-severity vulnerability in WordPress

WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

Published · Updated

Follow this CVE+ Monitor WordPress+ Monitor wordpress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.8%
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
WordPress Foundation · WordPress
Related CVEs — WordPress

In the same product, most dangerous first.

CVE-2026-119977HIGHWordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionEPSS 1.2%KEVCVE-2023-2745MEDIUMWordPress Core < 6.2.1 - Directory TraversalEPSS 79.7%CVE-2024-4439HIGHCVE-2024-4439EPSS 71.0%CVE-2024-6307MEDIUMWordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML APIEPSS 0.5%CVE-2022-4973MEDIUMWordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); functionEPSS 0.4%CVE-2026-3906MEDIUMWordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIEPSS 0.4%