CVE-2023-5561
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Summary
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Original description
The description as published by the source.
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Affected packages
Bitnami
wordpress
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.7.27"},{"introduced":"4.8.0"},{"fixed":"4.8.23"},{"introduced":"4.9.0"},{"fixed":"4.9.24"},{"introduced":"5.0.0"},{"fixed":"5.0.20"},{"introduced":"5.1.0"},{"fixed":"5.1.17"},{"introduced":"5.2.0"},{"fixed":"5.2.19"},{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"5.4.0"},{"fixed":"5.4.14"},{"introduced":"5.5.0"},{"fixed":"5.5.13"},{"introduced":"5.6.0"},{"fixed":"5.6.12"},{"introduced":"5.7.0"},{"fixed":"5.7.10"},{"introduced":"5.8.0"},{"fixed":"5.8.8"},{"introduced":"5.9.0"},{"fixed":"5.9.8"},{"introduced":"6.0.0"},{"fixed":"6.0.6"},{"introduced":"6.1.0"},{"fixed":"6.1.4"},{"introduced":"6.2.0"},{"fixed":"6.2.3"},{"introduced":"6.3.0"},{"fixed":"6.3.2"}]}]
Bitnami
wordpress-multisite
[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"4.7.27"},{"introduced":"4.8.0"},{"fixed":"4.8.23"},{"introduced":"4.9.0"},{"fixed":"4.9.24"},{"introduced":"5.0.0"},{"fixed":"5.0.20"},{"introduced":"5.1.0"},{"fixed":"5.1.17"},{"introduced":"5.2.0"},{"fixed":"5.2.19"},{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"5.4.0"},{"fixed":"5.4.14"},{"introduced":"5.5.0"},{"fixed":"5.5.13"},{"introduced":"5.6.0"},{"fixed":"5.6.12"},{"introduced":"5.7.0"},{"fixed":"5.7.10"},{"introduced":"5.8.0"},{"fixed":"5.8.8"},{"introduced":"5.9.0"},{"fixed":"5.9.8"},{"introduced":"6.0.0"},{"fixed":"6.0.6"},{"introduced":"6.1.0"},{"fixed":"6.1.4"},{"introduced":"6.2.0"},{"fixed":"6.2.3"},{"introduced":"6.3.0"},{"fixed":"6.3.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-5561 wordpress Fixed in: 5.7.11+dfsg1-0+deb11u1
References
- advisory nvd.nist.gov
- advisory github.com
- report wpscan.com
- web lists.debian.org
- web wpscan.com