Search for vulnerabilities
Vulnerability details: VCID-rh9a-aynp-c3fa
Vulnerability ID VCID-rh9a-aynp-c3fa
Aliases CVE-2023-5561
Summary WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.52532 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60359 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60359 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60359 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60785 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60785 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60785 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60785 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60926 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.60926 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
epss 0.69238 https://api.first.org/data/v1/epss?cve=CVE-2023-5561
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2023-5561
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-5561
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2745
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39999
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5561
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31210
https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
https://wpscan.com/blog/email-leak-oracle-vulnerability-addressed-in-wordpress-6-3-2/
https://wpscan.com/vulnerability/19380917-4c27-4095-abf1-eba6f913b441
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
CVE-2023-5561 https://nvd.nist.gov/vuln/detail/CVE-2023-5561
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-5561
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97821
EPSS Score 0.52532
Published At July 31, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T10:43:15.847565+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2023-5561 37.0.0