CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
What the vulnerability does
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Explanation of Vulnerability in Simple Terms
WordPress 5.4.0 contains an access control flaw that allows authenticated users with low privileges to view sensitive information from other users' accounts. The vulnerability requires the victim to interact with a malicious link or page. The impact is limited to confidentiality; the attacker cannot modify or delete data.
What an attacker can do
Read sensitive information from other users' accounts if they can trick a victim into clicking a link.
Potential impact on your site
Low-privilege users (subscribers, contributors) can view private data from other accounts if socially engineered.
Conditions required to exploit
Attacker must have a low-privilege WordPress account; victim must click a malicious link or visit a page.
Key dates
External resources
Related vulnerabilities
