title: WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
description: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
vendor: WordPress
product: WordPress
versions:
status: affected, version: 6.3.0, lessThan: 6.3.2, versionType: semver
status: affected, version: 6.2.0, lessThan: 6.2.3, versionType: semver
status: affected, version: 6.1.0, lessThan: 6.1.4, versionType: semver
status: affected, version: 6.0.0, lessThan: 6.0.6, versionType: semver
status: affected, version: 5.9.0, lessThan: 5.9.8, versionType: semver
status: affected, version: 5.8.0, lessThan: 5.8.8, versionType: semver
status: affected, version: 5.7.0, lessThan: 5.7.10, versionType: semver
status: affected, version: 5.6.0, lessThan: 5.6.12, versionType: semver
status: affected, version: 5.5.0, lessThan: 5.5.13, versionType: semver
status: affected, version: 5.4.0, lessThan: 5.4.14, versionType: semver
status: affected, version: 5.3.0, lessThan: 5.3.16, versionType: semver
status: affected, version: 5.2.0, lessThan: 5.2.19, versionType: semver
status: affected, version: 5.0.0, lessThan: 5.0.20, versionType: semver
status: affected, version: 4.9.0, lessThan: 4.9.24, versionType: semver
status: affected, version: 4.8.0, lessThan: 4.8.23, versionType: semver
status: affected, version: 4.7.0, lessThan: 4.7.27, versionType: semver
defaultStatus: unaffected
}