CVE-2023-5561

MEDIUMNuclei

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-5561 has a selected CVSS score of 5.3 (medium); EIP currently links 3 repository PoCs and 1 Nuclei template.

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WordPress

Browse WordPress / WordPress

Default status: unaffected

CVE List6.3.0 to < 6.3.2affected
6.2.0 to < 6.2.3affected
6.1.0 to < 6.1.4affected
6.0.0 to < 6.0.6affected
5.9.0 to < 5.9.8affected
5.8.0 to < 5.8.8affected
5.7.0 to < 5.7.10affected
5.6.0 to < 5.6.12affected
5.5.0 to < 5.5.13affected
5.4.0 to < 5.4.14affected
5.3.0 to < 5.3.16affected
5.2.0 to < 5.2.19affected
Showing 12 of 16 version ranges

Proofs of concept

3

Repository PoCs

GitHubdthkhang/CVE-2023-5561-PoCRepository PoCby dthkhang1Not analyzed2 files

3.8 KiB

GitHub
PoC details
GitHubpog007/CVE-2023-5561-PoCRepository PoCby pog0074Not analyzed2 files

2.5 KiB

GitHub
PoC details
GitHubrootxsushant/CVE-2023-5561-POC-UpdatedRepository PoCby rootxsushant3Not analyzed2 files

3.4 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Core - Post Author Email DisclosureCVSS 5.3

WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'list_users' capability, the search is applied to the user_email column.

Impact

This can allow unauthenticated attackers to brute force or verify the email addresses of users with published posts or pages on the site.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-200
Authorsnqdung2002
Template tagscvecve2023wpscandisclosurewpwordpressemailexposurevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:wordpress:wordpress"
Shodan: http.component:"wordpress"
FOFA: body="oembed" && body="wp-"
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-631-sensitive-information-exposure-via-user-search-rest-endpoint?asset_slug=wordpress https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441/ https://nvd.nist.gov/vuln/detail/CVE-2023-5561

Source: ProjectDiscovery

References

4