Medium
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
Type: advisorySources: OSV
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-5561
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 22:39 UTC · Revision 1
Source evidence
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
core-osv · Original sourcePublished 16 Oct 2023, 19:39 UTC
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
osv:CVE-2023-5561
Complete source record
{
"id": "1f5b8f7b34b3399c8ac4a3329a4f7863a0a07b7796524b3094f49171ec57d1fa",
"url": "https://osv.dev/vulnerability/CVE-2023-5561",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure",
"summary": "WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack",
"evidence": "osv:CVE-2023-5561",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-5561",
"aliases": [
"BIT-wordpress-2023-5561",
"BIT-wordpress-multisite-2023-5561",
"CVE-2023-5561"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress",
"type": "GIT",
"events": [
{
"introduced": "14247ee4302378d292863865c643abe99bbfe3c7"
},
{
"fixed": "03505cd7f9898a337013d638fffb15fb6237ac99"
},
{
"introduced": "06fa4161aa74619239cf27017d124081c825684a"
},
{
"fixed": "001372026131225d4039926bb39141710c30b3a2"
},
{
"introduced": "29ffbff370968ae48a1b7a34e35c8b8e75cf0f91"
},
{
"fixed": "ca00907bae8974ddff310fe67726c6946336a63c"
},
{
"introduced": "491c67be12ca8a9fe37ae38307ba7e298c976ec3"
},
{
"fixed": "37f24ed72a9b7d93fac02415e23cc244d2bb2efc"
},
{
"introduced": "c33464a4554cff8a082bc353d9226d8104b80d2b"
},
{
"fixed": "73d4c1c7eabaed5e23e032f889125837bb067d08"
},
{
"introduced": "6fe64752be3260f2a47f38e68c2cb77400e5a0c9"
},
{
"fixed": "974063fd8e375f8c0b9f9eab8267a7dff8f792ea"
},
{
"introduced": "50dc0ca5bb332c895f0f39fe4e6ee1e4a43e06dc"
},
{
"fixed": "5b4810a879c6bbb32e1b1d0d7c4748243b2f6572"
},
{
"introduced": "9ff4499281663b0c772787fd4a60538288f842e9"
},
{
"fixed": "5362cad58167451efd92a7c669295d10b0dc3e95"
},
{
"introduced": "537fd931bc02e6e934a2d774422b897871aa87ad"
},
{
"fixed": "068534071426b5794ccde15219f898ba3b2c560f"
},
{
"introduced": "965fcddcf68cf4fd122ae24b992e242dfea1d773"
},
{
"fixed": "078aab979f288508c09e4329628d3b67b1538d11"
},
{
"introduced": "058f9903676a7efaee534a682df0a2a8b87574d8"
},
{
"fixed": "1748dbad369310bf3611e175e0272df7e28a3d0d"
},
{
"introduced": "50caeb6e61ad0c49d2c7e1d6d5115047a011f590"
},
{
"fixed": "2324b11a547e10a16618246baf6deb2ed5a35165"
},
{
"introduced": "73157386d069425c5e6ea7c4fc0122e8a9b58a7b"
},
{
"fixed": "bcb0013f3603bc012836e3367d81b24790dd631a"
},
{
"introduced": "cc101b64012b16d087780657a2b828ccd7794a63"
},
{
"fixed": "105fef7fbd741e358810d5e7fda2fbf9c31ca997"
},
{
"introduced": "6c5d5b5dcb9712bfc400b09cb6627e42898527af"
},
{
"fixed": "b4591fa6388e470f60c87f6bd0182e577d3621bd"
},
{
"introduced": "17e2eff4aa3beb2802cbec12b6f08e2fbf69893d"
},
{
"fixed": "cf8d68b5ac4eec8d39f2f956f681d87720aaa8fb"
},
{
"introduced": "ac3899153a790a6f060dc816ff94812e0fd99875"
},
{
"fixed": "ffb401296259cc20eed753bf0f934221df45e32e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"fixed": "4.7.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.8"
},
{
"fixed": "4.8.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.9"
},
{
"fixed": "4.9.24"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0"
},
{
"fixed": "5.0.20"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.1"
},
{
"fixed": "5.1.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.2"
},
{
"fixed": "5.2.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.3"
},
{
"fixed": "5.3.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.4"
},
{
"fixed": "5.4.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.5"
},
{
"fixed": "5.5.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.6"
},
{
"fixed": "5.6.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.7"
},
{
"fixed": "5.7.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.8"
},
{
"fixed": "5.8.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.9"
},
{
"fixed": "5.9.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0"
},
{
"fixed": "6.0.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.1"
},
{
"fixed": "6.1.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2"
},
{
"fixed": "6.2.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.3"
},
{
"fixed": "6.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-5561.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wordpress/wordpress-develop",
"type": "GIT",
"events": [
{
"introduced": "efa83f48bd4ebd066e5efc94b9feefe50e7925a2"
},
{
"fixed": "44f6b667c73c73f311ccf30559bc31323f929882"
},
{
"introduced": "2ac9b801ef5c18accf223b093529dacfcf809133"
},
{
"fixed": "bc63b6d24681097c941bd66a4e432435dc499d6e"
},
{
"introduced": "31f7ece8503f0dc6ef1df2473ae3f3d352973e12"
},
{
"fixed": "37c9fa52052694a0d193de63c4dfc186e8adf4c3"
},
{
"introduced": "b3bf6266acd61682bc654845f621b4426645e324"
},
{
"fixed": "93fbaa291a2815c134d1069f7bee7b200265dd73"
},
{
"introduced": "5aa596fee9bf6ea7f0ccc2ed51b16c0f2f04076b"
},
{
"fixed": "a622b8bf311226b38d17bdc4bb65855d2f7138f8"
},
{
"introduced": "1cf3888655c0eb8b0b0539834ad67db5920190d7"
},
{
"fixed": "ff354fdc5259a23911c2a3843d42c2daabc527e2"
},
{
"introduced": "d05f0a86b23e37b9d97acd9317ff3fd661d64dea"
},
{
"fixed": "2b185061d5bfba8a879e7ef4ceebe924eb840dd9"
},
{
"introduced": "e0bedd676512ace4c5586337c072037298315f79"
},
{
"fixed": "5cef67a85eba41b569214a8242e45c6709acc3c6"
},
{
"introduced": "944a787b8071d3a27f4ac68980c21ed6137db91d"
},
{
"fixed": "611d84e47f9d4e4514932dee42b5cada658d1463"
},
{
"introduced": "96a6969aab5f0b9362cbc984af230bdfc93022e8"
},
{
"fixed": "36ab647c6df00d567140270e804290d112f9583f"
},
{
"introduced": "895d6a691d7ccdfe80cdf999bc0c8a78d11ad55a"
},
{
"fixed": "7b82e2d10eddbde2bb387e9bc298e091468b0919"
},
{
"introduced": "4b54a6c2c9a3be775cc6dda66ed207998b068c8f"
},
{
"fixed": "22ed420f9aa0ec9554ec68970f83b91b0faefb1e"
},
{
"introduced": "b83a8be65054cd890e24c7c1416ebbb39aeb4c09"
},
{
"fixed": "e5bce454ec3f1d6035b173de7391111956f69813"
},
{
"introduced": "1c0a2efa5eac05dfd3b7d2b9cfe68e02da55b966"
},
{
"fixed": "7b9658a0bf50ea03b5b85bf9ee135fb61b5ff4ac"
},
{
"introduced": "e33c9f3203961a823ec8410fc1481f6c87b4e3db"
},
{
"fixed": "4de18d1fbf375f6ce9e7241a14ac90303ef937fd"
},
{
"introduced": "b829903bb0104bfeccc7623946a25cb7ccda1dea"
},
{
"fixed": "4949dc0bdc03e93a7b38fa8a9520e8be34b6bce9"
},
{
"introduced": "4a6363076129378869f8742ef00a39a7421e6f29"
},
{
"fixed": "e8676f6226fb01cd17222c771717969f42e73505"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"fixed": "4.7.27"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.8"
},
{
"fixed": "4.8.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.9"
},
{
"fixed": "4.9.24"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0"
},
{
"fixed": "5.0.20"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.1"
},
{
"fixed": "5.1.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.2"
},
{
"fixed": "5.2.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.3"
},
{
"fixed": "5.3.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.4"
},
{
"fixed": "5.4.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.5"
},
{
"fixed": "5.5.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.6"
},
{
"fixed": "5.6.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.7"
},
{
"fixed": "5.7.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.8"
},
{
"fixed": "5.8.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.9"
},
{
"fixed": "5.9.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0"
},
{
"fixed": "6.0.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.1"
},
{
"fixed": "6.1.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2"
},
{
"fixed": "6.2.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.3"
},
{
"fixed": "6.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-5561.json"
}
}
],
"modified": "2026-10-28T02:30:23.945849380Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5561.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-5561",
"https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/",
"https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441"
],
"provider_metadata": {
"cna_assigner": "WPScan",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.2"
},
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.3"
},
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.4"
},
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.6"
},
{
"introduced": "5.9.0"
},
{
"fixed": "5.9.8"
},
{
"introduced": "5.8.0"
},
{
"fixed": "5.8.8"
},
{
"introduced": "5.7.0"
},
{
"fixed": "5.7.10"
},
{
"introduced": "5.6.0"
},
{
"fixed": "5.6.12"
},
{
"introduced": "5.5.0"
},
{
"fixed": "5.5.13"
},
{
"introduced": "5.4.0"
},
{
"fixed": "5.4.14"
},
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.16"
},
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.19"
},
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.20"
},
{
"introduced": "4.9.0"
},
{
"fixed": "4.9.24"
},
{
"introduced": "4.8.0"
},
{
"fixed": "4.8.23"
},
{
"introduced": "4.7.0"
},
{
"fixed": "4.7.27"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5561.json"
}
},
"related_cves": [
{
"value": "CVE-2023-5561",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490623,
"published_at": "2023-10-16T19:39:10.424+00:00"
}