CVE-2023-39999
Status: ModifiedMedium (4.3)—
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.04%
- Percentile among all scored CVEs: 63
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-200
- NVD-CWE-noinfo
References
- https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/
- https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve
- https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve
- https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/
- https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve
- https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve
Raw JSON (NVD)
Show
{
"id": "CVE-2023-39999",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "audit@patchstack.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "audit@patchstack.com",
"affectedData": [
{
"vendor": "WordPress.org",
"product": "WordPress",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "6.3.2",
"status": "unaffected"
}
],
"version": "6.3",
"versionType": "custom",
"lessThanOrEqual": "6.3.1"
},
{
"status": "affected",
"changes": [
{
"at": "6.2.3",
"status": "unaffected"
}
],
"version": "6.2",
"versionType": "custom",
"lessThanOrEqual": "6.2.2"
},
{
"status": "affected",
"changes": [
{
"at": "6.1.4",
"status": "unaffected"
}
],
"version": "6.1",
"versionType": "custom",
"lessThanOrEqual": "6.1.3"
},
{
"status": "affected",
"changes": [
{
"at": "6.0.6",
"status": "unaffected"
}
],
"version": "6.0",
"versionType": "custom",
"lessThanOrEqual": "6.0.5"
},
{
"status": "affected",
"changes": [
{
"at": "5.9.8",
"status": "unaffected"
}
],
"version": "5.9",
"versionType": "custom",
"lessThanOrEqual": "5.9.7"
},
{
"status": "affected",
"changes": [
{
"at": "5.8.8",
"status": "unaffected"
}
],
"version": "5.8",
"versionType": "custom",
"lessThanOrEqual": "5.8.7"
},
{
"status": "affected",
"changes": [
{
"at": "5.7.10",
"status": "unaffected"
}
],
"version": "5.7",
"versionType": "custom",
"lessThanOrEqual": "5.7.9"
},
{
"status": "affected",
"changes": [
{
"at": "5.6.12",
"status": "unaffected"
}
],
"version": "5.6",
"versionType": "custom",
"lessThanOrEqual": "5.6.11"
},
{
"status": "affected",
"changes": [
{
"at": "5.5.13",
"status": "unaffected"
}
],
"version": "5.5",
"versionType": "custom",
"lessThanOrEqual": "5.5.12"
},
{
"status": "affected",
"changes": [
{
"at": "5.4.14",
"status": "unaffected"
}
],
"version": "5.4",
"versionType": "custom",
"lessThanOrEqual": "5.4.13"
},
{
"status": "affected",
"changes": [
{
"at": "5.3.16",
"status": "unaffected"
}
],
"version": "5.3",
"versionType": "custom",
"lessThanOrEqual": "5.3.15"
},
{
"status": "affected",
"changes": [
{
"at": "5.2.19",
"status": "unaffected"
}
],
"version": "5.2",
"versionType": "custom",
"lessThanOrEqual": "5.2.18"
},
{
"status": "affected",
"changes": [
{
"at": "5.1.17",
"status": "unaffected"
}
],
"version": "5.1",
"versionType": "custom",
"lessThanOrEqual": "5.1.16"
},
{
"status": "affected",
"changes": [
{
"at": "5.0.20",
"status": "unaffected"
}
],
"version": "5.0",
"versionType": "custom",
"lessThanOrEqual": "5.0.19"
},
{
"status": "affected",
"changes": [
{
"at": "4.9.24",
"status": "unaffected"
}
],
"version": "4.9",
"versionType": "custom",
"lessThanOrEqual": "4.9.23"
},
{
"status": "affected",
"changes": [
{
"at": "4.8.23",
"status": "unaffected"
}
],
"version": "4.8",
"versionType": "custom",
"lessThanOrEqual": "4.8.22"
},
{
"status": "affected",
"changes": [
{
"at": "4.7.27",
"status": "unaffected"
}
],
"version": "4.7",
"versionType": "custom",
"lessThanOrEqual": "4.7.26"
},
{
"status": "affected",
"changes": [
{
"at": "4.6.27",
"status": "unaffected"
}
],
"version": "4.6",
"versionType": "custom",
"lessThanOrEqual": "4.6.26"
},
{
"status": "affected",
"changes": [
{
"at": "4.5.30",
"status": "unaffected"
}
],
"version": "4.5",
"versionType": "custom",
"lessThanOrEqual": "4.5.29"
},
{
"status": "affected",
"changes": [
{
"at": "4.4.31",
"status": "unaffected"
}
],
"version": "4.4",
"versionType": "custom",
"lessThanOrEqual": "4.4.30"
},
{
"status": "affected",
"changes": [
{
"at": "4.3.32",
"status": "unaffected"
}
],
"version": "4.3",
"versionType": "custom",
"lessThanOrEqual": "4.3.31"
},
{
"status": "affected",
"changes": [
{
"at": "4.2.36",
"status": "unaffected"
}
],
"version": "4.2",
"versionType": "custom",
"lessThanOrEqual": "4.2.35"
},
{
"status": "affected",
"changes": [
{
"at": "4.1.39",
"status": "unaffected"
}
],
"version": "4.1",
"versionType": "custom",
"lessThanOrEqual": "4.1.38"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-10-13T12:15:09.970",
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve",
"tags": [
"Third Party Advisory"
],
"source": "audit@patchstack.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "audit@patchstack.com",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38."
},
{
"lang": "es",
"value": "Exposición de Información Confidencial a un Actor No Autorizado en WordPress desde 6.3 hasta 6.3.1, desde 6.2 hasta 6.2.2, desde 6.1 hasta 6.13, desde 6.0 hasta 6.0.5, desde 5.9 hasta 5.9.7, desde 5.8 hasta 5.8.7, del 5.7 al 5.7.9, del 5.6 al 5.6.11, del 5.5 al 5.5.12, del 5.4 al 5.4.13, del 5.3 al 5.3.15, del 5.2 al 5.2.18, del 5.1 al 5.1.16, del 5.0 al 5.0.19, del 4.9 al 4.9.23, del 4.8 al 4.8.22, del 4.7 al 4.7.26, del 4.6 al 4.6.26, del 4.5 al 4.5.29, del 4.4 al 4.4.30, del 4.3 al 4.3.31, del 4.2 al 4.2.35, del 4.1 al 4.1.38."
}
],
"lastModified": "2026-10-05T13:16:48.530",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABB9B812-77A2-48A2-B20C-F93F1927074D",
"versionEndIncluding": "4.1.38",
"versionStartIncluding": "4.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E1AF690-CF5B-43EC-BFC3-0D3BFBD68026",
"versionEndIncluding": "4.2.35",
"versionStartIncluding": "4.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C16E8601-4A33-46DD-8ED7-4D0366D627C6",
"versionEndIncluding": "4.3.31",
"versionStartIncluding": "4.3"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5045F892-3036-4887-9044-9560EC8E4CC4",
"versionEndIncluding": "4.4.30",
"versionStartIncluding": "4.4"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "847B4EEB-CE33-4FE7-BE01-7F26FA214CA7",
"versionEndIncluding": "4.5.29",
"versionStartIncluding": "4.5"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F10FE77A-E6E4-4F22-ACD9-B5302D330AEC",
"versionEndIncluding": "4.6.26",
"versionStartIncluding": "4.6"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26FF60CD-3303-4B7E-A341-1336A1B59B02",
"versionEndIncluding": "4.7.26",
"versionStartIncluding": "4.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DB9AC76-3041-4B4C-8015-3FB4F997F3D0",
"versionEndIncluding": "4.8.22",
"versionStartIncluding": "4.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C37B8606-CDC9-41AE-A215-8C4CAA181FE2",
"versionEndIncluding": "4.9.23",
"versionStartIncluding": "4.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F999E7C-2623-456C-BB90-0477F797FEEF",
"versionEndIncluding": "5.0.19",
"versionStartIncluding": "5.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D3ED9AF-2678-45E9-9D05-87DDB335B3A8",
"versionEndIncluding": "5.1.16",
"versionStartIncluding": "5.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AC73861-C8F7-4CF3-BD3E-E192B21C6E9A",
"versionEndIncluding": "5.2.18",
"versionStartIncluding": "5.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2C8561A-B374-43F1-A075-B3C0CAA34790",
"versionEndIncluding": "5.3.15",
"versionStartIncluding": "5.3"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D20123C6-5E39-41D4-8231-8E02B78997BC",
"versionEndIncluding": "5.4.13",
"versionStartIncluding": "5.4"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C69CC301-A008-4BAF-A207-0892673CAEFF",
"versionEndIncluding": "5.5.12",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A83D406-52C7-4655-9048-9393A3D23DA4",
"versionEndIncluding": "5.6.11",
"versionStartIncluding": "5.6"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6797639F-F04C-4BFA-B37B-98E9D23D8E33",
"versionEndIncluding": "5.7.9",
"versionStartIncluding": "5.7"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CD23244-9849-453C-A206-4563997EF5EE",
"versionEndIncluding": "5.8.7",
"versionStartIncluding": "5.8"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51D5D6E9-387D-4A4B-A613-0E0B9D74B8F1",
"versionEndIncluding": "5.9.7",
"versionStartIncluding": "5.9"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D0A0B36-9A2F-415A-A404-EE0FF6BC63A3",
"versionEndIncluding": "6.0.5",
"versionStartIncluding": "6.0"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A85EAB94-7EE7-4B4D-82E6-132FCF8662C4",
"versionEndIncluding": "6.1.3",
"versionStartIncluding": "6.1"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B55FDB69-E699-43A1-8575-52E0B33F8863",
"versionEndIncluding": "6.2.2",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4ED48F8A-D2AC-45FE-9B5F-231A0666A897",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "6.3"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "audit@patchstack.com"
}