Skip to content
OpenAdvisories
Medium · 4.3 CVE-2023-39999 EUVD-2023-43692GHSA-4pqc-j77p-x3p2

WordPress < 6.3.2 is vulnerable to Broken Access Control

Published Oct 13, 2023 · Updated Oct 5, 2026 · Assigned by Patchstack

Description

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.

Affected products

VendorProductAffectedFixed
WordPress.org WordPress 6.3 – ≤ 6.3.1, 6.2 – ≤ 6.2.2, 6.1 – ≤ 6.1.3, 6.0 – ≤ 6.0.5, 5.9 – ≤ 5.9.7, 5.8 – ≤ 5.8.7, 5.7 – ≤ 5.7.9, 5.6 – ≤ 5.6.11, 5.5 – ≤ 5.5.12, 5.4 – ≤ 5.4.13, 5.3 – ≤ 5.3.15, 5.2 – ≤ 5.2.18, 5.1 – ≤ 5.1.16, 5.0 – ≤ 5.0.19, 4.9 – ≤ 4.9.23, 4.8 – ≤ 4.8.22, 4.7 – ≤ 4.7.26, 4.6 – ≤ 4.6.26, 4.5 – ≤ 4.5.29, 4.… —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wordpress 6.3.2+dfsg1-1 —
Debian 13 wordpress 6.3.2+dfsg1-1 —
Debian 12 wordpress 6.1.6+dfsg1-0+deb12u1 DSA-5685-1
Debian 11 wordpress 5.7.11+dfsg1-0+deb11u1 DSA-5685-1
Debian 10 wordpress 5.0.20+dfsg1-0+deb10u1 DLA-3658-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wordpress No fix yet —
Ubuntu 26.04 LTS wordpress No fix yet —
Ubuntu 25.10 wordpress No fix yet —
Ubuntu 24.04 LTS wordpress No fix yet —
Ubuntu 22.04 LTS wordpress No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wordpress No fix yet —
Ubuntu 18.04 LTS wordpress No fix yet —
Ubuntu 16.04 LTS wordpress No fix yet —

Advisories 3

References