CVE-2023-5561: fallo de gravedad media en WordPress
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Publicada el · Actualizada el
28Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.3epss 3.9%
probabilidad de explotación
3.9%top 10% de las CVE
explotación observada
noninguna fuente lo reporta
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WordPress · WordPressCVEs relacionadas — WordPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-87902HIGHCVE-2026-87902EPSS 46.1%KEVCVE-2026-63030CRITICALWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionEPSS 10.1%KEVCVE-2026-60137MEDIUMWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryEPSS 5.9%KEVCVE-2020-11027MEDIUMPassword reset links invalidation issue in WordPressEPSS 13.6%CVE-2022-3590MEDIUMWP <= 6.1.1 - Unauthenticated Blind SSRF via DNS RebindingEPSS 3.2%CVE-2020-11028MEDIUMUnauthenticated disclosure of certain private posts in WordPressEPSS 2.3%