WordPress < 5.2.4 - Unauthenticated Exposure of Sensitive Information via Static Query Property
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-17671. PoCs published by Sebastian Neef, rhbb. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a writeup describing how to exploit an information leakage vulnerability in WordPress by manipulating URL parameters. It explains that adding `?static=1` to a WordPress URL can leak secret content, and further manipulation with `order` and `orderby` parameters can expose additional data.
Description
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
Exploits (2)
This is a writeup describing how to exploit an information leakage vulnerability in WordPress by manipulating URL parameters. It explains that adding `?static=1` to a WordPress URL can leak secret content, and further manipulation with `order` and `orderby` parameters can expose additional data.
The repository lacks functional exploit code and only provides a Docker setup for WordPress 5.2.3. The README contains minimal details and references external images without technical depth.
Nuclei Templates (1)
http.component:"wordpress" http.html:"status-draft"
body="Wordpress" && body="status-draft"
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N