{"id":"CVE-2023-5561","summary":"WordPress \u003c 6.3.2 - Unauthenticated Post Author Email Disclosure","details":"WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack","aliases":["BIT-wordpress-2023-5561","BIT-wordpress-multisite-2023-5561"],"modified":"2026-08-12T03:30:29.911711318Z","published":"2023-10-16T19:39:10.424Z","database_specific":{"cna_assigner":"WPScan","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5561.json","unresolved_ranges":[{"extracted_events":[{"introduced":"6.3.0"},{"fixed":"6.3.2"},{"introduced":"6.2.0"},{"fixed":"6.2.3"},{"introduced":"6.1.0"},{"fixed":"6.1.4"},{"introduced":"6.0.0"},{"fixed":"6.0.6"},{"introduced":"5.9.0"},{"fixed":"5.9.8"},{"introduced":"5.8.0"},{"fixed":"5.8.8"},{"introduced":"5.7.0"},{"fixed":"5.7.10"},{"introduced":"5.6.0"},{"fixed":"5.6.12"},{"introduced":"5.5.0"},{"fixed":"5.5.13"},{"introduced":"5.4.0"},{"fixed":"5.4.14"},{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"5.2.0"},{"fixed":"5.2.19"},{"introduced":"5.0.0"},{"fixed":"5.0.20"},{"introduced":"4.9.0"},{"fixed":"4.9.24"},{"introduced":"4.8.0"},{"fixed":"4.8.23"},{"introduced":"4.7.0"},{"fixed":"4.7.27"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5561.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5561"},{"type":"ARTICLE","url":"https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/"},{"type":"EVIDENCE","url":"https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wordpress/wordpress","events":[{"introduced":"14247ee4302378d292863865c643abe99bbfe3c7"},{"fixed":"03505cd7f9898a337013d638fffb15fb6237ac99"},{"introduced":"06fa4161aa74619239cf27017d124081c825684a"},{"fixed":"001372026131225d4039926bb39141710c30b3a2"},{"introduced":"29ffbff370968ae48a1b7a34e35c8b8e75cf0f91"},{"fixed":"ca00907bae8974ddff310fe67726c6946336a63c"},{"introduced":"491c67be12ca8a9fe37ae38307ba7e298c976ec3"},{"fixed":"37f24ed72a9b7d93fac02415e23cc244d2bb2efc"},{"introduced":"c33464a4554cff8a082bc353d9226d8104b80d2b"},{"fixed":"73d4c1c7eabaed5e23e032f889125837bb067d08"},{"introduced":"6fe64752be3260f2a47f38e68c2cb77400e5a0c9"},{"fixed":"974063fd8e375f8c0b9f9eab8267a7dff8f792ea"},{"introduced":"50dc0ca5bb332c895f0f39fe4e6ee1e4a43e06dc"},{"fixed":"5b4810a879c6bbb32e1b1d0d7c4748243b2f6572"},{"introduced":"9ff4499281663b0c772787fd4a60538288f842e9"},{"fixed":"5362cad58167451efd92a7c669295d10b0dc3e95"},{"introduced":"537fd931bc02e6e934a2d774422b897871aa87ad"},{"fixed":"068534071426b5794ccde15219f898ba3b2c560f"},{"introduced":"965fcddcf68cf4fd122ae24b992e242dfea1d773"},{"fixed":"078aab979f288508c09e4329628d3b67b1538d11"},{"introduced":"058f9903676a7efaee534a682df0a2a8b87574d8"},{"fixed":"1748dbad369310bf3611e175e0272df7e28a3d0d"},{"introduced":"50caeb6e61ad0c49d2c7e1d6d5115047a011f590"},{"fixed":"2324b11a547e10a16618246baf6deb2ed5a35165"},{"introduced":"73157386d069425c5e6ea7c4fc0122e8a9b58a7b"},{"fixed":"bcb0013f3603bc012836e3367d81b24790dd631a"},{"introduced":"cc101b64012b16d087780657a2b828ccd7794a63"},{"fixed":"105fef7fbd741e358810d5e7fda2fbf9c31ca997"},{"introduced":"6c5d5b5dcb9712bfc400b09cb6627e42898527af"},{"fixed":"b4591fa6388e470f60c87f6bd0182e577d3621bd"},{"introduced":"17e2eff4aa3beb2802cbec12b6f08e2fbf69893d"},{"fixed":"cf8d68b5ac4eec8d39f2f956f681d87720aaa8fb"},{"introduced":"ac3899153a790a6f060dc816ff94812e0fd99875"},{"fixed":"ffb401296259cc20eed753bf0f934221df45e32e"}],"database_specific":{"cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.7"},{"fixed":"4.7.27"},{"introduced":"4.8"},{"fixed":"4.8.23"},{"introduced":"4.9"},{"fixed":"4.9.24"},{"introduced":"5.0"},{"fixed":"5.0.20"},{"introduced":"5.1"},{"fixed":"5.1.17"},{"introduced":"5.2"},{"fixed":"5.2.19"},{"introduced":"5.3"},{"fixed":"5.3.16"},{"introduced":"5.4"},{"fixed":"5.4.14"},{"introduced":"5.5"},{"fixed":"5.5.13"},{"introduced":"5.6"},{"fixed":"5.6.12"},{"introduced":"5.7"},{"fixed":"5.7.10"},{"introduced":"5.8"},{"fixed":"5.8.8"},{"introduced":"5.9"},{"fixed":"5.9.8"},{"introduced":"6.0"},{"fixed":"6.0.6"},{"introduced":"6.1"},{"fixed":"6.1.4"},{"introduced":"6.2"},{"fixed":"6.2.3"},{"introduced":"6.3"},{"fixed":"6.3.2"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-5561.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/wordpress/wordpress-develop","events":[{"introduced":"efa83f48bd4ebd066e5efc94b9feefe50e7925a2"},{"fixed":"44f6b667c73c73f311ccf30559bc31323f929882"},{"introduced":"2ac9b801ef5c18accf223b093529dacfcf809133"},{"fixed":"bc63b6d24681097c941bd66a4e432435dc499d6e"},{"introduced":"31f7ece8503f0dc6ef1df2473ae3f3d352973e12"},{"fixed":"37c9fa52052694a0d193de63c4dfc186e8adf4c3"},{"introduced":"b3bf6266acd61682bc654845f621b4426645e324"},{"fixed":"93fbaa291a2815c134d1069f7bee7b200265dd73"},{"introduced":"5aa596fee9bf6ea7f0ccc2ed51b16c0f2f04076b"},{"fixed":"a622b8bf311226b38d17bdc4bb65855d2f7138f8"},{"introduced":"1cf3888655c0eb8b0b0539834ad67db5920190d7"},{"fixed":"ff354fdc5259a23911c2a3843d42c2daabc527e2"},{"introduced":"d05f0a86b23e37b9d97acd9317ff3fd661d64dea"},{"fixed":"2b185061d5bfba8a879e7ef4ceebe924eb840dd9"},{"introduced":"e0bedd676512ace4c5586337c072037298315f79"},{"fixed":"5cef67a85eba41b569214a8242e45c6709acc3c6"},{"introduced":"944a787b8071d3a27f4ac68980c21ed6137db91d"},{"fixed":"611d84e47f9d4e4514932dee42b5cada658d1463"},{"introduced":"96a6969aab5f0b9362cbc984af230bdfc93022e8"},{"fixed":"36ab647c6df00d567140270e804290d112f9583f"},{"introduced":"895d6a691d7ccdfe80cdf999bc0c8a78d11ad55a"},{"fixed":"7b82e2d10eddbde2bb387e9bc298e091468b0919"},{"introduced":"4b54a6c2c9a3be775cc6dda66ed207998b068c8f"},{"fixed":"22ed420f9aa0ec9554ec68970f83b91b0faefb1e"},{"introduced":"b83a8be65054cd890e24c7c1416ebbb39aeb4c09"},{"fixed":"e5bce454ec3f1d6035b173de7391111956f69813"},{"introduced":"1c0a2efa5eac05dfd3b7d2b9cfe68e02da55b966"},{"fixed":"7b9658a0bf50ea03b5b85bf9ee135fb61b5ff4ac"},{"introduced":"e33c9f3203961a823ec8410fc1481f6c87b4e3db"},{"fixed":"4de18d1fbf375f6ce9e7241a14ac90303ef937fd"},{"introduced":"b829903bb0104bfeccc7623946a25cb7ccda1dea"},{"fixed":"4949dc0bdc03e93a7b38fa8a9520e8be34b6bce9"},{"introduced":"4a6363076129378869f8742ef00a39a7421e6f29"},{"fixed":"e8676f6226fb01cd17222c771717969f42e73505"}],"database_specific":{"extracted_events":[{"introduced":"4.7"},{"fixed":"4.7.27"},{"introduced":"4.8"},{"fixed":"4.8.23"},{"introduced":"4.9"},{"fixed":"4.9.24"},{"introduced":"5.0"},{"fixed":"5.0.20"},{"introduced":"5.1"},{"fixed":"5.1.17"},{"introduced":"5.2"},{"fixed":"5.2.19"},{"introduced":"5.3"},{"fixed":"5.3.16"},{"introduced":"5.4"},{"fixed":"5.4.14"},{"introduced":"5.5"},{"fixed":"5.5.13"},{"introduced":"5.6"},{"fixed":"5.6.12"},{"introduced":"5.7"},{"fixed":"5.7.10"},{"introduced":"5.8"},{"fixed":"5.8.8"},{"introduced":"5.9"},{"fixed":"5.9.8"},{"introduced":"6.0"},{"fixed":"6.0.6"},{"introduced":"6.1"},{"fixed":"6.1.4"},{"introduced":"6.2"},{"fixed":"6.2.3"},{"introduced":"6.3"},{"fixed":"6.3.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-5561.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}