{"id":"CVE-2023-39999","title":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9…","summary":"Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200"],"vendor":"wordpress","product":"wordpress","affected":["wordpress >= 4.1, <= 4.1.38","wordpress >= 4.2, <= 4.2.35","wordpress >= 4.3, <= 4.3.31","wordpress >= 4.4, <= 4.4.30","wordpress >= 4.5, <= 4.5.29","wordpress >= 4.6, <= 4.6.26","wordpress >= 4.7, <= 4.7.26","wordpress >= 4.8, <= 4.8.22","wordpress >= 4.9, <= 4.9.23","wordpress >= 5.0, <= 5.0.19","wordpress >= 5.1, <= 5.1.16","wordpress >= 5.2, <= 5.2.18","wordpress >= 5.3, <= 5.3.15","wordpress >= 5.4, <= 5.4.13","wordpress >= 5.5, <= 5.5.12","wordpress >= 5.6, <= 5.6.11","wordpress >= 5.7, <= 5.7.9","wordpress >= 5.8, <= 5.8.7","wordpress >= 5.9, <= 5.9.7","wordpress >= 6.0, <= 6.0.5","wordpress >= 6.1, <= 6.1.3","wordpress >= 6.2, <= 6.2.2","wordpress >= 6.3, < 6.3.2","fedora = 37","fedora = 38"],"patched":["wordpress 6.3.2"],"published":"2023-10-13","updated":"2026-10-05","sourceUpdated":"2026-10-05T13:16:48.530","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-39999","references":[{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","label":"audit@patchstack.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","label":"audit@patchstack.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","label":"audit@patchstack.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","label":"audit@patchstack.com"},{"url":"https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","label":"audit@patchstack.com"},{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","label":"audit@patchstack.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00014.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EVFT4DPZRFTXJPEPADM22BZVIUD2P66/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCCVDPKOK57WCTH2QJ5DJM3B53RJNZKA/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQBL4ZQCBFNQ76XHM5257CIBFQRGT5QY/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://patchstack.com/articles/wordpress-core-6-3-2-security-update-technical-advisory?_s_id=cve","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://patchstack.com/database/vulnerability/wordpress/wordpress-wordpress-core-core-6-3-2-contributor-comment-read-on-private-and-password-protected-post-vulnerability?_s_id=cve","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.01045,"epssPercentile":0.62924,"ingestedAt":"2026-10-05T13:20:09.429Z","slug":"CVE-2023-39999","body":"## Overview\n\nExposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.\n\n## Affected\n\n- `wordpress >= 4.1, <= 4.1.38`\n- `wordpress >= 4.2, <= 4.2.35`\n- `wordpress >= 4.3, <= 4.3.31`\n- `wordpress >= 4.4, <= 4.4.30`\n- `wordpress >= 4.5, <= 4.5.29`\n- `wordpress >= 4.6, <= 4.6.26`\n- `wordpress >= 4.7, <= 4.7.26`\n- `wordpress >= 4.8, <= 4.8.22`\n- `wordpress >= 4.9, <= 4.9.23`\n- `wordpress >= 5.0, <= 5.0.19`\n- `wordpress >= 5.1, <= 5.1.16`\n- `wordpress >= 5.2, <= 5.2.18`\n- `wordpress >= 5.3, <= 5.3.15`\n- `wordpress >= 5.4, <= 5.4.13`\n- `wordpress >= 5.5, <= 5.5.12`\n- `wordpress >= 5.6, <= 5.6.11`\n- `wordpress >= 5.7, <= 5.7.9`\n- `wordpress >= 5.8, <= 5.8.7`\n- `wordpress >= 5.9, <= 5.9.7`\n- `wordpress >= 6.0, <= 6.0.5`\n- `wordpress >= 6.1, <= 6.1.3`\n- `wordpress >= 6.2, <= 6.2.2`\n- `wordpress >= 6.3, < 6.3.2`\n- `fedora = 37`\n- `fedora = 38`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wordpress 6.3.2`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}