WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
28Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.3epss 3.9%
probabilidad de explotación
3.9%top 11% de las CVE
explotación observada
noninguna fuente lo reporta
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WordPress · WordPress