What happened
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
Affected versions
WordPress: 6.3 through 6.3.1 (custom); 6.2 through 6.2.2 (custom); 6.1 through 6.1.3 (custom); 6.0 through 6.0.5 (custom); 5.9 through 5.9.7 (custom); 5.8 through 5.8.7 (custom); 5.7 through 5.7.9 (custom); 5.6 through 5.6.11 (custom); 5.5 through 5.5.12 (custom); 5.4 through 5.4.13 (custom); 5.3 through 5.3.15 (custom); 5.2 through 5.2.18 (custom); 5.1 through 5.1.16 (custom); 5.0 through 5.0.19 (custom); 4.9 through 4.9.23 (custom); 4.8 through 4.8.22 (custom); 4.7 through 4.7.26 (custom); 4.6 through 4.6.26 (custom); 4.5 through 4.5.29 (custom); 4.4 through 4.4.30 (custom); 4.3 through 4.3.31 (custom); 4.2 through 4.2.35 (custom); 4.1 through 4.1.38 (custom) Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.