{"id":"CVE-2025-54352","aliases":["DEBIAN-CVE-2025-54352","EUVD-2025-22048","GHSA-585c-5qcq-7fgc","UBUNTU-CVE-2025-54352"],"status":"published","title":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts...","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00402,"percentile":0.34703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-669"],"published":"2025-07-21T00:00:00Z","modified":"2026-10-17T12:58:37Z","exploits":[{"source":"pocgithub","id":"limmmw/CVE-2025-54352","title":"limmmw/CVE-2025-54352","date":"2025-10-08","url":"https://github.com/limmmw/CVE-2025-54352"},{"source":"pocgithub","id":"mufasa-noir/XMLRPC-Pingback-vulnerability-POC","title":"mufasa-noir/XMLRPC-Pingback-vulnerability-POC","date":"2025-11-27","url":"https://github.com/mufasa-noir/XMLRPC-Pingback-vulnerability-POC"},{"source":"pocgithub","id":"yohannslm/CVE-2025-54352","title":"yohannslm/CVE-2025-54352","date":"2025-07-28","url":"https://github.com/yohannslm/CVE-2025-54352"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+dfsg1-1","6.1.6+dfsg1-0+deb12u1","6.1.9+dfsg1-0+deb12u1","6.2+dfsg1-1","6.2.1+dfsg1-1","6.2.2+dfsg1-1","6.3+dfsg1-1","6.3.1+dfsg1-1","6.3.2+dfsg1-1","6.4.1+dfsg1-1","6.4.1+dfsg1-1.1","6.4.2+dfsg1-1","6.4.3+dfsg1-1","6.5+dfsg1-1","6.5.2+dfsg1-1","6.5.3+dfsg1-1","6.5.5+dfsg1-1","6.6.1+dfsg1-1","6.7.2+dfsg1-1","6.7.2+dfsg1-1.1","6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-0+deb13u1","6.8.3+dfsg1-1","6.8.6+dfsg1-0+deb13u1","6.8.7+dfsg1-0+deb13u1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1","7.0.2+dfsg1-1","7.0.3+dfsg1-1","7.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://www.imperva.com/blog/beware-a-threat-actor-could-steal-the-titles-of-your-private-and-draft-wordpress-posts/","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54352"},{"url":"https://www.imperva.com/blog/beware-a-threat-actor-could-steal-the-titles-of-your-private-and-draft-wordpress-posts"},{"url":"https://github.com/advisories/GHSA-585c-5qcq-7fgc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-54352","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-54352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54352","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-54352","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T00:00:00Z","modified":"2025-07-21T18:15:20.785Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-22048","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T00:00:00Z","modified":"2025-07-21T18:15:20Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:06.121511Z"}],"ghsa":[{"id":"GHSA-585c-5qcq-7fgc","title":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts...","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T06:31:19Z","modified":"2025-07-21T06:31:24Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:03:04.468862Z"}],"nvd":[{"id":"CVE-2025-54352","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T05:15:38.75Z","modified":"2026-06-17T09:39:55.293Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"DEBIAN-CVE-2025-54352","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T05:15:38.75Z","modified":"2026-09-01T20:05:54.52596531Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-54352","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T05:15:00Z","modified":"2026-10-17T12:58:37.158527656Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CVE-2025-54352","description":"WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.","status":"published","published":"2025-07-21T05:15:38Z","modified":"2026-04-10T05:29:32.280714Z","updated_at":"2026-11-02T15:44:50.863921Z"}]}}