CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
Explanation of Vulnerability in Simple Terms
WordPress core versions up to 6.4.3 expose sensitive information through an information disclosure vulnerability. An unauthenticated attacker on the network can retrieve limited confidential data without user interaction. The vulnerability does not allow modification or deletion of data. Site administrators should update WordPress to a version newer than 6.4.3.
What an attacker can do
Read sensitive information from the WordPress site without authentication.
Potential impact on your site
Confidential data may be exposed to unauthenticated visitors; integrity and availability are not affected.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
