In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
Max CVSS
5.3
EPSS Score
1.56%
Published
2019-10-17
Updated
2023-02-03
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Max CVSS
7.5
EPSS Score
1.03%
Published
2018-12-14
Updated
2019-03-04
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
Max CVSS
5.3
EPSS Score
0.53%
Published
2017-01-30
Updated
2019-03-19
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
Max CVSS
5.3
EPSS Score
87.41%
Published
2017-01-15
Updated
2017-09-01
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Max CVSS
7.5
EPSS Score
0.57%
Published
2016-06-29
Updated
2016-11-30
The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Max CVSS
5.0
EPSS Score
0.73%
Published
2015-11-09
Updated
2017-09-21
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Max CVSS
5.0
EPSS Score
0.35%
Published
2012-01-30
Updated
2024-04-11
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.
Max CVSS
5.0
EPSS Score
0.57%
Published
2008-01-10
Updated
2018-10-15
8 vulnerabilities found