Unauthorized User Field Exposure in WordPress REST API
Summary
CVE-2023-5561: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website vi... Affects wordpress across 3 version ranges.
< 5.7.11+dfsg1-0+deb11u1
>= 14247ee4302378d292863865c643abe99bbfe3c7, < 03505cd7f9898a337013d638fffb15fb6237ac99
>= efa83f48bd4ebd066e5efc94b9feefe50e7925a2, < 44f6b667c73c73f311ccf30559bc31323f929882
Fixed in 5.7.11+dfsg1-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used content management system (CMS) that allows users to create and manage websites easily. It features a REST API that enables developers to interact with WordPress programmatically. However, a recent vulnerability has been identified that affects the way user fields are handled through this API, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2023-5561, arises from improper restrictions in the WordPress REST API, which allows unauthenticated attackers to search for user fields that should remain private. This flaw can lead to an Oracle-style attack, where attackers can discern the email addresses of users who have published public posts on affected websites. The implications of this vulnerability are significant, as it compromises user privacy and can facilitate further attacks.
How To Fix
Minimum fixed version
5.7.11+dfsg1-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wordpressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, site administrators can restrict access to the REST API for unauthenticated users by implementing custom code in their theme's functions.php file. For example, add the following code snippet:
function restrict_rest_api_access() {
if (!is_user_logged_in()) {
remove_action('rest_api_init', 'rest_api_init');
}
}
add_action('init', 'restrict_rest_api_access');
Conclusion
CVE-2023-5561 is a critical vulnerability in WordPress that exposes user email addresses through the REST API. It is essential for site administrators to update their installations to the latest versions to protect user privacy and prevent potential attacks. Implementing the suggested workaround can provide temporary relief until the update is applied.
See every vulnerability recorded for wordpress →
FAQ
CVE-2023-5561 is a vulnerability in WordPress that allows unauthenticated attackers to access user email addresses through the REST API.
If your WordPress version is prior to the fixed versions mentioned, your site may be vulnerable. You can check your version in the WordPress admin dashboard.
The primary risk is the exposure of user email addresses, which can lead to spam, phishing attacks, or further exploitation of user accounts.
It is recommended to update your WordPress installation as soon as new updates are released to ensure you have the latest security patches.
Yes, Vulert can monitor your application for open-source vulnerabilities like CVE-2023-5561 using a manifest file such as package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
