Description
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress Foundation | WordPress | ≤ 6.4.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 6.5+dfsg1-1 | — |
| Debian 13 | wordpress | 6.5+dfsg1-1 | — |
| Debian 12 | wordpress | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | wordpress | No fix yet | — |
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Advisories 1
- WID-SEC-2024-0808 WordPress: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 27, 2024
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6f993b-ce09-4050-84a1-cbe9953f36b1?source=cve
- https://github.com/WordPress/wordpress-develop/blob/6.3/src/wp-includes/canonical.php#L763
- https://developer.wordpress.org/reference/functions/is_post_publicly_viewable/
- https://developer.wordpress.org/reference/functions/is_post_type_viewable/
- https://core.trac.wordpress.org/changeset/57645