CVE-2023-5692

MEDIUM 5.3

WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.

CWE	CWE-200
Vendor	wordpress foundation
Product	wordpress
Ecosystems	PHP CMS
Industries	WebMedia
Published	Apr 5, 2024
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for wordpress foundation wordpress

Be the first to know when new medium vulnerabilities affecting wordpress foundation wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

WordPress Foundation / WordPress

0 ≤ 6.4.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6f993b-ce09-4050-84a1-cbe9953f36b1?source=cve github.com: https://github.com/WordPress/wordpress-develop/blob/6.3/src/wp-includes/canonical.php#L763 developer.wordpress.org: https://developer.wordpress.org/reference/functions/is_post_publicly_viewable/ developer.wordpress.org: https://developer.wordpress.org/reference/functions/is_post_type_viewable/ core.trac.wordpress.org: https://core.trac.wordpress.org/changeset/57645

Credits

Francesco Carlucci