Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Remediation

References

CVE-2023-5561

Related Vulnerabilities

PHP Resource Management Errors Vulnerability (CVE-2015-8877)

WordPress Plugin Advanced Shipment Tracking for WooCommerce Security Bypass (3.2.6)

Phusion Passenger Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2119)

WordPress Plugin Booking Ultra Pro Appointments Booking Calendar Local File Inclusion (1.1.13)

WordPress Plugin Floating Chat Widget:Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button-Chaty SQL Injection (3.0.2)

Severity

Medium

Classification

CVE-2023-5561 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities