CVE-2023-5692

What it actually does

The redirect_guess_404_permalink function in WordPress Core leaks the slug of custom posts configured with 'publicly_queryable' set to false when processing unauthenticated 404 requests.

Why it matters to the business

Organizations may unintentionally reveal internal content structure or hidden post identifiers, undermining access controls on non-public content and increasing risk of targeted follow-on attacks.

How an attack unfolds

An unauthenticated attacker crafts HTTP requests that trigger 404 responses on paths resembling custom post slugs; the flawed permalink guessing logic returns the hidden slug in the response, exposing it without authentication.

How to fix it

Update WordPress Core to the latest stable release that resolves the issue in the redirect_guess_404_permalink function; apply all available security updates promptly.

How to confirm the fix worked

Verify the installed WordPress version is newer than 6.4.3; test by requesting paths that would previously leak slugs and confirm no sensitive information is returned in responses.

Typical attack path

1. Identify a WordPress site running a vulnerable version.
2. Send crafted requests to non-existent paths that match patterns of custom post types.
3. Observe responses containing leaked slugs for posts marked non-publicly queryable.
4. Use discovered slugs to probe further or craft targeted attacks against protected content.

How to detect it

Review web server access logs for unusual 404 requests to paths that may match custom post slug patterns; look for repeated requests resulting in responses that include post identifiers.

What your security team should do

• Prioritize updating WordPress Core across all instances to the newest version.
• Review custom post type configurations to ensure sensitive posts are properly protected.
• Monitor for any anomalous 404 traffic patterns targeting permalink structures.