What is CVE-2023-39999?

CVE-2023-39999 is a medium-severity vulnerability in WordPress, a popular content management system. This issue allows unauthenticated attackers to discern the email addresses of users who have published public posts, exposing sensitive information. The vulnerability affects a wide range of WordPress versions, making it essential to update systems to protect against potential threats.

Who is impacted by CVE-2023-39999?

CVE-2023-39999 affects users of WordPress versions 4.1 to 6.3.1. This vulnerability allows unauthorized actors to obtain the email addresses of users who have published public posts. It is crucial for organizations and individuals using these WordPress versions to be aware of this issue and take necessary precautions.

What to do if CVE-2023-39999 affected you

If you're affected by the CVE-2023-39999 vulnerability, it's essential to update your WordPress system to a secure version. Follow these steps:

1. Identify your WordPress version and check if it falls within the affected range (4.1 to 6.3.1).

2. Backup your website before making any changes.

3. Update your WordPress installation to the latest secure version, depending on your system (e.g., Debian 10 buster users should update to version 5.0.20+dfsg1-0+deb10u1).

4. Monitor security announcements and apply future updates as needed.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-39999 vulnerability, which affects WordPress and exposes sensitive information to unauthorized actors, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue allows attackers to access users' email addresses who have published public posts on affected websites. To protect against this vulnerability, it is essential to update your WordPress system to a secure version and monitor security announcements for future updates.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-200, which involves exposure of sensitive information to unauthorized actors.

Learn More

For a comprehensive understanding of this issue, including its description, severity, technical details, and affected software configurations, consult the NVD page and the resources listed below.

• Debian LTS security update

• Fedora 38 Update: wordpress-6.3.2-1.fc38