Fluid Attacks Database

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	wordpress	=6.1.1+dfsg1-1 \|\| >=0 <6.1.6+dfsg1-0+deb12u1	6.1.6+dfsg1-0+deb12u1
debian 13	wordpress	>=0 <6.3.2+dfsg1-1	6.3.2+dfsg1-1
debian 11	wordpress	=5.7.1+dfsg1-2 \|\| =5.7.3+dfsg1-0+deb11u1 \|\| =5.7.5+dfsg1-0+deb11u1 \|\| =5.7.8+dfsg1-0+deb11u1 \|\| =5.7.8+dfsg1-0+deb11u2 \|\| >=0 <5.7.11+dfsg1-0+deb11u1	5.7.11+dfsg1-0+deb11u1
debian 14	wordpress	>=0 <6.3.2+dfsg1-1	6.3.2+dfsg1-1

Aliases

1. CVE-2023-55612. NVD-2023-55613. OSV-DEBIAN-2023-55614. OSV-2023-55615. SECURITY-TRACKER-CVE-2023-5561

References

1. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5561.yaml2. https://github.com/pog007/CVE-2023-5561-PoC

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.