What the vulnerability does
01Description
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 6.3 and 6.3.1 expose sensitive information to authenticated users with low privileges. An attacker with a basic user account can read data they should not have access to. The vulnerability requires an active WordPress login but no additional user interaction. Update to a version newer than 6.3.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
04Site Impact
User data or site configuration details may be exposed to low-privilege accounts, risking privacy or competitive information leaks.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., Subscriber or Contributor).
Key dates
06Disclosure timeline
October 13, 2023
CVE published
April 28, 2026
Record updated
