WordPress core

CVE-2023-5561

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Severity: Medium 5.3
Published: 16 Oct 2023
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	From 6.3 before 6.3.2 From 6.2 before 6.2.3 From 6.1 before 6.1.4 From 6.0 before 6.0.6 All 17 release lines From 4.7 before 4.7.27 From 4.8 before 4.8.23 From 4.9 before 4.9.24 From 5.0 before 5.0.20 From 5.1 before 5.1.17 From 5.2 before 5.2.19 From 5.3 before 5.3.16 From 5.4 before 5.4.14 From 5.5 before 5.5.13 From 5.6 before 5.6.12 From 5.7 before 5.7.10 From 5.8 before 5.8.8 From 5.9 before 5.9.8 From 6.0 before 6.0.6 From 6.1 before 6.1.4 From 6.2 before 6.2.3 From 6.3 before 6.3.2

WordPressWordPress core · cpe:a:wordpress:wordpress

From 6.3 before 6.3.2
From 6.2 before 6.2.3
From 6.1 before 6.1.4
From 6.0 before 6.0.6

All 17 release lines

From 4.7 before 4.7.27
From 4.8 before 4.8.23
From 4.9 before 4.9.24
From 5.0 before 5.0.20
From 5.1 before 5.1.17
From 5.2 before 5.2.19
From 5.3 before 5.3.16
From 5.4 before 5.4.14
From 5.5 before 5.5.13
From 5.6 before 5.6.12
From 5.7 before 5.7.10
From 5.8 before 5.8.8
From 5.9 before 5.9.8
From 6.0 before 6.0.6
From 6.1 before 6.1.4
From 6.2 before 6.2.3
From 6.3 before 6.3.2

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-5561
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-5561