CVE-2025-54352
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-07-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | 6.8.2 |
| wordpress | wordpress | 3.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-669 | The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in WordPress versions 3.5 through 6.8.2 allows remote attackers to guess the titles of private and draft posts by sending pingback.ping XML-RPC requests. This means that even posts that are not publicly published could have their titles exposed to unauthorized users.
How can this vulnerability impact me? :
The impact of this vulnerability is limited disclosure of information, specifically the titles of private and draft posts. While it does not allow modification or deletion of content, it can lead to unintended exposure of sensitive or confidential information contained in post titles.