CVE

CVE-2023-5561

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

Attack Vector

Network

Privileges Req.

None

User Interaction

None

wordpress

Updated Oct 24, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~1 minutes

CVE-2023-5561 Scanner

CVE-2023-5561 Scanner - Information Disclosure vulnerability in WordPress Core

Used 3k times · 3.4k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: wordpress

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →