CVE catalog

CVE-2023-39999

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.19% · Oct 25, 2026

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwordpresssid7.1.3+dfsg1-1fixed
Debianwordpressforky7.1.3+dfsg1-1fixed
Debianwordpresstrixie6.8.7+dfsg1-0+deb13u1fixed
Debianwordpresstrixie-security6.8.10+dfsg1-0+deb13u1fixed
Debianwordpressbookworm6.1.9+dfsg1-0+deb12u1fixed
Debianwordpressbookworm-security6.1.9+dfsg1-0+deb12u1fixed
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown
CpewordpressNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwordpresssourcesid6.3.2+dfsg1-1not yet assignedNot reportedNot reported
Debianwordpresssourceforky6.3.2+dfsg1-1not yet assignedNot reportedNot reported
Debianwordpresssourcetrixie6.3.2+dfsg1-1not yet assignedNot reportedNot reported
Debianwordpresssourcebookworm6.1.6+dfsg1-0+deb12u1not yet assignedNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References