CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
Explanation of Vulnerability in Simple Terms
WordPress versions 4.70 through 5.7.0 expose sensitive user metadata to authenticated users who should not have access to it. An attacker with a low-privilege account can read private information about other users, including email addresses and other profile data. This affects any WordPress site where multiple user accounts exist.
What an attacker can do
Read private user metadata and email addresses of other site users.
Potential impact on your site
User privacy is compromised; private profile data is visible to low-privilege accounts.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
