CVE-2023-5561: WordPress Information Disclosure Flaw

CVE-2023-5561 Overview

CVE-2023-5561 is an information disclosure vulnerability in WordPress that allows unauthenticated attackers to enumerate email addresses of users who have published public posts on affected websites. The vulnerability exists because WordPress does not properly restrict which user fields are searchable via the REST API, enabling attackers to leverage an Oracle-style attack technique to systematically discover email addresses.

This vulnerability is particularly concerning because it requires no authentication, can be exploited remotely over the network, and exposes personally identifiable information (PII) that could be leveraged for subsequent phishing campaigns, credential stuffing attacks, or social engineering attempts.

Critical Impact

Unauthenticated attackers can enumerate email addresses of WordPress users who have published posts, potentially exposing thousands of user accounts to phishing and targeted attacks.

Affected Products

• WordPress versions prior to 4.1.39
• WordPress versions 4.2 through 5.0 prior to patched releases
• WordPress versions 5.1 through 6.3.1

Discovery Timeline

• October 16, 2023 - CVE-2023-5561 published to NVD
• April 23, 2025 - Last updated in NVD database

Technical Details for CVE-2023-5561

Vulnerability Analysis

The vulnerability resides in WordPress's REST API implementation, specifically in how user data is handled during search queries. The REST API exposes endpoints that allow searching for users, but the application fails to adequately restrict which user fields can be queried. This implementation flaw enables an Oracle-style attack where an attacker can infer sensitive information based on the API's response behavior.

In an Oracle attack context, the attacker submits carefully crafted queries to the REST API endpoint and observes whether the response indicates a match or no match. By iteratively testing character combinations and analyzing the differential responses, an attacker can reconstruct email addresses character-by-character. This technique bypasses traditional access controls because the information is inferred from legitimate API behavior rather than directly returned in response bodies.

The attack is particularly effective against WordPress sites with public posts because the user accounts associated with those posts become queryable through the REST API. The confidentiality impact allows exposure of email addresses which are often considered sensitive PII and can be leveraged for secondary attacks.

Root Cause

The root cause of CVE-2023-5561 is insufficient access control and improper filtering of searchable user fields in the WordPress REST API. The application allows queries against user attributes that should not be exposed to unauthenticated users, including the email field. The REST API's search functionality was designed to support legitimate user discovery features but failed to implement proper field-level security restrictions.

The lack of rate limiting on the REST API endpoints further exacerbates this vulnerability, allowing attackers to perform the iterative queries required for Oracle-style enumeration without detection or throttling.

Attack Vector

The attack vector for CVE-2023-5561 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target WordPress installation with the REST API enabled (enabled by default)
2. Locating users who have published public posts on the site
3. Sending crafted search queries to the REST API user endpoint
4. Analyzing response patterns to determine if partial email matches exist
5. Iteratively refining queries to enumerate complete email addresses

The attack can be fully automated and executed against multiple WordPress installations simultaneously. Since the REST API is enabled by default in WordPress, the attack surface is extensive across the millions of WordPress sites on the internet.

The Oracle-style attack works by testing if a partial email string matches any user account. Based on subtle differences in API responses (such as result counts, response times, or specific fields returned), the attacker can determine whether their guess was correct and proceed to enumerate the next character.

Detection Methods for CVE-2023-5561

Indicators of Compromise

• Unusual volume of REST API requests to /wp-json/wp/v2/users endpoint
• Sequential or iterative search patterns in API query parameters suggesting enumeration attempts
• Multiple requests from the same IP address with incrementally varying search terms
• API request logs showing search queries targeting email-related patterns

Detection Strategies

• Monitor web server access logs for high-frequency requests to WordPress REST API user endpoints
• Implement anomaly detection for search patterns that follow character-by-character enumeration behavior
• Deploy Web Application Firewall (WAF) rules to detect and block rapid sequential REST API queries
• Use intrusion detection systems to flag unusual API traffic patterns from unauthenticated sources

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests including query parameters
• Set up alerting thresholds for REST API request rates from single IP addresses
• Monitor for failed authentication attempts following email enumeration (indicating secondary attacks)
• Track geographic origin of REST API traffic to identify suspicious access patterns

How to Mitigate CVE-2023-5561

Immediate Actions Required

• Update WordPress to version 6.3.2 or the latest patched version immediately
• Review REST API access logs for signs of prior exploitation
• Consider temporarily restricting REST API access if updates cannot be applied immediately
• Notify users whose email addresses may have been exposed about potential phishing risks

Patch Information

WordPress addressed this vulnerability in version 6.3.2 with fixes backported to earlier maintained branches. The patch restricts which user fields are searchable via the REST API for unauthenticated users, preventing the Oracle-style enumeration attack. For detailed information about the security fix, see the WPScan Blog Post on Oracle Leak and the WPScan Vulnerability Report.

Debian users should refer to the Debian LTS Security Announcement for distribution-specific patches.

Workarounds

• Use a security plugin to disable or restrict the WordPress REST API user endpoints
• Implement rate limiting at the web server or reverse proxy level for REST API endpoints
• Deploy a Web Application Firewall (WAF) with rules to block enumeration attack patterns
• Consider disabling the REST API entirely if not required for site functionality using plugins like Disable REST API

# Apache configuration to rate limit REST API requests
# Add to .htaccess or Apache configuration
<Location "/wp-json/wp/v2/users">
    # Limit requests to REST API user endpoint
    SetEnvIf Request_URI "^/wp-json/wp/v2/users" rest_api_request
    # Log REST API requests for monitoring
    CustomLog /var/log/apache2/rest-api.log combined env=rest_api_request
</Location>