CVE-2023-5561
Fixed in a distro release EPSS 4%CVSS 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Products: WordPress
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | wordpress | 5.0.20+dfsg1-0+deb10u1 |
| Debian 11 | wordpress | 5.7.11+dfsg1-0+deb11u1 |
| Debian 12 | wordpress | 6.1.6+dfsg1-0+deb12u1 |
| Debian 13 | wordpress | 6.3.2+dfsg1-1 |
| Debian 14 | wordpress | 6.3.2+dfsg1-1 |
| Ubuntu 16.04 LTS | wordpress | no fix |
| Ubuntu 18.04 LTS | wordpress | no fix |
| Ubuntu 20.04 LTS | wordpress | no fix |
| Ubuntu 22.04 LTS | wordpress | no fix |
| Ubuntu 24.04 LTS | wordpress | no fix |