Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-17671 — Sensitive Information Exposure in Wordpress

CWE-200 — Sensitive Information Exposure11 documents8 sources
Severity
5.3MEDIUMNVD
EPSS
66.7%
top 1.45%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
WordpressDebian WordpressDebian Linux
Timeline
PublishedOct 17
Latest updateMay 24

Description

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 5.2.4+dfsg1-1 (bookworm)
▶NVDwordpress/wordpress< 5.2.4
▶Debianwordpress/wordpress< 5.2.4+dfsg1-1+3

Also affects: Debian Linux 10.0, 8.0, 9.0

Patches

Patch: blog.wpscan.org ↗Patch: core.trac.wordpress.org ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-q76h-h683-9cc8: In WordPress before 5↗2022-05-24
▶
OSV
CVE-2019-17671: In WordPress before 5↗2019-10-17
▶

💥Exploits & PoCs

2
Exploit-DB
WordPress Core < 5.2.3 - Viewing Unauthenticated/Password/Private Posts↗2019-10-14
▶
Nuclei
WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts
▶

📋Vendor Advisories

1
Debian
CVE-2019-17671: wordpress - In WordPress before 5.2.4, unauthenticated viewing of certain content is possibl...↗2019
▶

💬Community

5
HackerOne
Version problem in wordpress leads to the many vulnearability↗2020-01-10
▶
Bugzilla
CVE-2019-17671 wordpress: unauthenticated viewing of certain content is possible because the static query property is mishandled [fedora-all]↗2019-11-19
▶
Bugzilla
CVE-2019-17671 wordpress: unauthenticated viewing of certain content is possible because the static query property is mishandled↗2019-11-19
▶
Bugzilla
CVE-2019-17671 wordpress: unauthenticated viewing of certain content is possible because the static query property is mishandled [epel-6]↗2019-11-19
▶
Bugzilla
CVE-2019-17671 wordpress: unauthenticated viewing of certain content is possible because the static query property is mishandled [epel-7]↗2019-11-19
▶
CVE-2019-17671 — Sensitive Information Exposure | cvebase