Medium severity · published Oct 16, 2023
CVE-2023-5561
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have…
5.3
CVSS
4.3%
EPSS
No
On KEV
Description
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · WordPress
4.7 before 4.7.27; 4.8 before 4.8.23; 4.9 before 4.9.24; 5.0 before 5.0.20; 5.1 before 5.1.17; 5.2 before 5.2.19; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5561
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
Exploit
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/
Third Party Advisory
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441
More from WordPress
9.8
CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
9.8
CVE-2020-25213
WordPress File Manager Plugin Remote Code Execution Vulnerability
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
8.1
CVE-2026-87902
WordPress Core Remote File Inclusion Vulnerability
7.5
CVE-2020-11738
WordPress Snap Creek Duplicator Plugin File Download Vulnerability