CVE-2023-5561: WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Other sources
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.1.9+dfsg1-0+deb12u1Fixed in 6.8.7+dfsg1-0+deb13u1Fixed in 6.8.12+dfsg1-0+deb13u1Fixed in 7.1.4+dfsg1-1 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 6.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5561?
The severity of CVE-2023-5561 is medium with a CVSS score of 5.3.
What is the affected software for CVE-2023-5561?
The Popup Builder WordPress plugin versions 4.1.15 and earlier are affected.
How can a high privilege user exploit CVE-2023-5561?
A high privilege user such as an admin can exploit CVE-2023-5561 to perform Stored Cross-Site Scripting attacks.
Can CVE-2023-5561 be exploited even if unfiltered_html capability is disallowed?
Yes, CVE-2023-5561 can be exploited even when the unfiltered_html capability is disallowed.
Is there a fix for CVE-2023-5561?
Yes, make sure to update the Popup Builder WordPress plugin to version 4.1.16 or later to fix CVE-2023-5561.