CVE-2023-5561 PoC — WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

Source

https://github.com/rootxsushant/CVE-2023-5561-POC-Updated

Associated Vulnerability

Title: WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure (CVE-2023-5561)
Description:WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Description

Updated POC for Unauth Post Author Email Disclosures WordPress CVE-2023-5561

Readme

# CVE-2023-5561-POC-Updated

This repository contains a modified version of the original Proof-of-Concept (PoC) for CVE-2023-5561. The original PoC, which can be found <a href=https://github.com/pog007/CVE-2023-5561-PoC>here</a>, sends a high volume of requests in parallel, which may trigger Web Application Firewalls (WAFs) or cause the server to block the connection due to excessive traffic.

# Modification

- Added a 10-second delay between each request in the bruteforce_search function using time.sleep(10). This helps prevent the PoC from overwhelming the target server.
- The core functionality of the exploit remains unchanged, ensuring the PoC still works effectively while reducing the likelihood of detection and blocking.

# Usage

``` python3 poc.py <target site root url> ```

This version is useful for conducting responsible security assessments while minimizing the risk of being blocked due to aggressive request patterns.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →