WordPress Vulnerabilities

WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure

Description

WordPress does not correctly filter post types in some cases when guessing a permalink, which could allow unauthenticated users to discover the slugs of content excluded from search.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6
6.8.6
Fixed in WordPress 6.8.7
6.8.5
Fixed in WordPress 6.8.7
6.8.4
Fixed in WordPress 6.8.7
6.8.3
Fixed in WordPress 6.8.7
6.8.2
Fixed in WordPress 6.8.7
6.8.1
Fixed in WordPress 6.8.7
6.8
Fixed in WordPress 6.8.7
6.7.5
Fixed in WordPress 7.0.3
6.7.4
Fixed in WordPress 7.0.3
6.7.3
Fixed in WordPress 7.0.3
6.7.2
Fixed in WordPress 7.0.3
6.7.1
Fixed in WordPress 7.0.3
6.7
Fixed in WordPress 7.0.3
6.6.5
Fixed in WordPress 7.0.3
6.6.4
Fixed in WordPress 7.0.3
6.6.3
Fixed in WordPress 7.0.3
6.6.2
Fixed in WordPress 7.0.3
6.6.1
Fixed in WordPress 7.0.3
6.6
Fixed in WordPress 7.0.3
6.5.8
Fixed in WordPress 7.0.3
6.5.7
Fixed in WordPress 7.0.3
6.5.6
Fixed in WordPress 7.0.3
6.5.5
Fixed in WordPress 7.0.3
6.5.4
Fixed in WordPress 7.0.3
6.5.3
Fixed in WordPress 7.0.3
6.5.2
Fixed in WordPress 7.0.3
6.5
Fixed in WordPress 7.0.3
6.4.8
Fixed in WordPress 7.0.3
6.4.7
Fixed in WordPress 7.0.3
6.4.6
Fixed in WordPress 7.0.3
6.4.5
Fixed in WordPress 7.0.3
6.4.4
Fixed in WordPress 7.0.3
6.4.3
Fixed in WordPress 7.0.3
6.4.2
Fixed in WordPress 7.0.3
6.4.1
Fixed in WordPress 7.0.3
6.4
Fixed in WordPress 7.0.3
6.3.8
Fixed in WordPress 7.0.3
6.3.7
Fixed in WordPress 7.0.3
6.3.6
Fixed in WordPress 7.0.3
6.3.5
Fixed in WordPress 7.0.3
6.3.4
Fixed in WordPress 7.0.3
6.3.3
Fixed in WordPress 7.0.3
6.3.2
Fixed in WordPress 7.0.3
6.3.1
Fixed in WordPress 7.0.3
6.3
Fixed in WordPress 7.0.3
6.2.9
Fixed in WordPress 7.0.3
6.2.8
Fixed in WordPress 7.0.3
6.2.7
Fixed in WordPress 7.0.3
6.2.6
Fixed in WordPress 7.0.3
6.2.5
Fixed in WordPress 7.0.3
6.2.4
Fixed in WordPress 7.0.3
6.2.3
Fixed in WordPress 7.0.3
6.2.2
Fixed in WordPress 7.0.3
6.2.1
Fixed in WordPress 7.0.3
6.2
Fixed in WordPress 7.0.3
6.1.10
Fixed in WordPress 7.0.3
6.1.9
Fixed in WordPress 7.0.3
6.1.8
Fixed in WordPress 7.0.3
6.1.7
Fixed in WordPress 7.0.3
6.1.6
Fixed in WordPress 7.0.3
6.1.5
Fixed in WordPress 7.0.3
6.1.4
Fixed in WordPress 7.0.3
6.1.3
Fixed in WordPress 7.0.3
6.1.2
Fixed in WordPress 7.0.3
6.1.1
Fixed in WordPress 7.0.3
6.1
Fixed in WordPress 7.0.3
6.0.12
Fixed in WordPress 7.0.3
6.0.11
Fixed in WordPress 7.0.3
6.0.10
Fixed in WordPress 7.0.3
6.0.9
Fixed in WordPress 7.0.3
6.0.8
Fixed in WordPress 7.0.3
6.0.7
Fixed in WordPress 7.0.3
6.0.6
Fixed in WordPress 7.0.3
6.0.5
Fixed in WordPress 7.0.3
6.0.4
Fixed in WordPress 7.0.3
6.0.3
Fixed in WordPress 7.0.3
6.0.2
Fixed in WordPress 7.0.3
6.0.1
Fixed in WordPress 7.0.3
6.0
Fixed in WordPress 7.0.3
5.9.13
Fixed in WordPress 7.0.3
5.9.12
Fixed in WordPress 7.0.3
5.9.11
Fixed in WordPress 7.0.3
5.9.10
Fixed in WordPress 7.0.3
5.9.9
Fixed in WordPress 7.0.3
5.9.8
Fixed in WordPress 7.0.3
5.9.7
Fixed in WordPress 7.0.3
5.9.6
Fixed in WordPress 7.0.3
5.9.5
Fixed in WordPress 7.0.3
5.9.4
Fixed in WordPress 7.0.3
5.9.3
Fixed in WordPress 7.0.3
5.9.2
Fixed in WordPress 7.0.3
5.9.1
Fixed in WordPress 7.0.3
5.9
Fixed in WordPress 7.0.3
5.8.13
Fixed in WordPress 7.0.3
5.8.12
Fixed in WordPress 7.0.3
5.8.11
Fixed in WordPress 7.0.3
5.8.10
Fixed in WordPress 7.0.3
5.8.9
Fixed in WordPress 7.0.3
5.8.8
Fixed in WordPress 7.0.3
5.8.7
Fixed in WordPress 7.0.3
5.8.6
Fixed in WordPress 7.0.3
5.8.5
Fixed in WordPress 7.0.3
5.8.4
Fixed in WordPress 7.0.3
5.8.3
Fixed in WordPress 7.0.3
5.8.2
Fixed in WordPress 7.0.3
5.8.1
Fixed in WordPress 7.0.3
5.8
Fixed in WordPress 7.0.3
5.7.15
Fixed in WordPress 7.0.3
5.7.14
Fixed in WordPress 7.0.3
5.7.13
Fixed in WordPress 7.0.3
5.7.12
Fixed in WordPress 7.0.3
5.7.11
Fixed in WordPress 7.0.3
5.7.10
Fixed in WordPress 7.0.3
5.7.9
Fixed in WordPress 7.0.3
5.7.8
Fixed in WordPress 7.0.3
5.7.7
Fixed in WordPress 7.0.3
5.7.6
Fixed in WordPress 7.0.3
5.7.5
Fixed in WordPress 7.0.3
5.7.4
Fixed in WordPress 7.0.3
5.7.3
Fixed in WordPress 7.0.3
5.7.2
Fixed in WordPress 7.0.3
5.7.1
Fixed in WordPress 7.0.3
5.7
Fixed in WordPress 7.0.3
5.6.17
Fixed in WordPress 7.0.3
5.6.16
Fixed in WordPress 7.0.3
5.6.15
Fixed in WordPress 7.0.3
5.6.14
Fixed in WordPress 7.0.3
5.6.13
Fixed in WordPress 7.0.3
5.6.12
Fixed in WordPress 7.0.3
5.6.11
Fixed in WordPress 7.0.3
5.6.10
Fixed in WordPress 7.0.3
5.6.9
Fixed in WordPress 7.0.3
5.6.8
Fixed in WordPress 7.0.3
5.6.7
Fixed in WordPress 7.0.3
5.6.6
Fixed in WordPress 7.0.3
5.6.5
Fixed in WordPress 7.0.3
5.6.4
Fixed in WordPress 7.0.3
5.6.3
Fixed in WordPress 7.0.3
5.6.2
Fixed in WordPress 7.0.3
5.6.1
Fixed in WordPress 7.0.3
5.6
Fixed in WordPress 7.0.3

References

CVE
CVE-2023-5692
URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
HDWSec
Verified
Yes
WPVDB ID
cc82dffb-16ea-4ae1-a513-e3ada8e574a0

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2025-10-31
Title
WP Discourse < 2.6.0 - Authenticated (Author+) Information Exposure
Published
2023-07-19
Title
Essential Addons For Elementor < 5.8.2 - Unauthenticated MailChimp API Key Disclosure
Published
2023-12-28
Title
Affiliates Manager < 2.9.31 - Sensitive Information Exposure via Log File
Published
2024-10-21
Title
TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure
Published
2025-07-29
Title
Atarim < 4.2.2 - Unauthenticated Information Exposure