CVE-2025-54352 Details
Description
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
A vulnerability exists in WordPress versions 3.5 through 6.8.2, allowing remote attackers to infer the titles of private and draft posts by sending pingback.ping requests via XML-RPC. This issue arises because the pingback feature, enabled by default in new WordPress installations since 3.5, does not restrict title searches to public posts only. As a result, an attacker can exploit this by crafting requests that probe for specific substrings, effectively leaking sensitive information about unpublished content.
WordPress users are advised to update to the latest version and disable the XML-RPC pingback feature if it is not needed. Imperva customers are already protected against this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2025CISA-ADP
Assessed Jul 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.imperva.com/blog/beware-a-threat-actor-could-steal-the-titles-of-your-private-and-draft-wordpress-posts/ | [email protected] | ExploitMedia CoverageRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-669 | Incorrect Resource Transfer Between Spheres | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WordPress | >= 3.5, <= 6.8.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2025 | New CVE Received | [email protected] |