CVE-2025-54352
LOW 3.7EPSS 0.4%
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
- Affected
- WordPress
- CVSS v3.1 MITRE
- 3.7 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.37% chance of exploitation in the next 30 days, 30th percentile
- Published
- 2025-07-21
Proof-of-concept exploits (3)
- yohannslm/CVE-2025-543521★ · 2025-07-29
- limmmw/CVE-2025-543520★ · 2025-10-08
- mufasa-noir/XMLRPC-Pingback-vulnerability-POC0★ · 2025-11-29