CVE-2023-5561 PoC — WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

Source

https://github.com/pog007/CVE-2023-5561-PoC

Associated Vulnerability

Title: WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure (CVE-2023-5561)
Description:WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Readme

# CVE-2023-5561-PoC
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Source:
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →