Email Leak Oracle Vulnerability Addressed in WordPress 6.3.2

        /**
         * Retrieves all users.
         *
         * @since 4.7.0
         *
         * @param WP_REST_Request $request Full details about the request.
         * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
         */
        public function get_items( $request ) {
                // Retrieve the list of registered collection query parameters.
                $registered = $this->get_collection_params();
                /*
                 * This array defines mappings between public API query parameters whose
                 * values are accepted as-passed, and their internal WP_Query parameter
                 * name equivalents (some are the same). Only values which are also
                 * present in $registered will be set.
                 */
                $parameter_mappings = array(
                        'exclude'      => 'exclude',
                        'include'      => 'include',
                        'order'        => 'order',
                        'per_page'     => 'number',
                        'search'       => 'search',
                        'roles'        => 'role__in',
                        'capabilities' => 'capability__in',
                        'slug'         => 'nicename__in',
                );
                $prepared_args = array();
                /*
                 * For each known parameter which is both registered and present in the request,
                 * set the parameter's value on the query $prepared_args.
                 */
                foreach ( $parameter_mappings as $api_param => $wp_param ) {
                        if ( isset( $registered[ $api_param ], $request[ $api_param ] ) ) {
                                $prepared_args[ $wp_param ] = $request[ $api_param ];
                        }
                }

               // (...)

                if ( ! empty( $prepared_args['search'] ) ) {
                        $prepared_args['search'] = '*' . $prepared_args['search'] . '*';
                }
                /**
                 * Filters WP_User_Query arguments when querying users via the REST API.
                 *
                 * @link https://developer.wordpress.org/reference/classes/wp_user_query/
                 *
                 * @since 4.7.0
                 *
                 * @param array           $prepared_args Array of arguments for WP_User_Query.
                 * @param WP_REST_Request $request       The REST API request.
                 */
                $prepared_args = apply_filters( 'rest_user_query', $prepared_args, $request );
                $query = new WP_User_Query( $prepared_args );

		$search = '';
		if ( isset( $qv['search'] ) ) {
			$search = trim( $qv['search'] );
		}

		if ( $search ) {
			$leading_wild  = ( ltrim( $search, '*' ) != $search );
			$trailing_wild = ( rtrim( $search, '*' ) != $search );
			if ( $leading_wild && $trailing_wild ) {
				$wild = 'both';
			} elseif ( $leading_wild ) {
				$wild = 'leading';
			} elseif ( $trailing_wild ) {
				$wild = 'trailing';
			} else {
				$wild = false;
			}
			if ( $wild ) {
				$search = trim( $search, '*' );
			}

			$search_columns = array();
			if ( $qv['search_columns'] ) {
				$search_columns = array_intersect( $qv['search_columns'], array( 'ID', 'user_login', 'user_email', 'user_url', 'user_nicename', 'display_name' ) );
			}
			if ( ! $search_columns ) {
				if ( false !== strpos( $search, '@' ) ) {
					$search_columns = array( 'user_email' );
				} elseif ( is_numeric( $search ) ) {
					$search_columns = array( 'user_login', 'ID' );
				} elseif ( preg_match( '|^https?://|', $search ) && ! ( is_multisite() && wp_is_large_network( 'users' ) ) ) {
					$search_columns = array( 'user_url' );
				} else {
					$search_columns = array( 'user_login', 'user_url', 'user_email', 'user_nicename', 'display_name' );
				}
			}