CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.

CVSS v3.1

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2025-07-21

Proof-of-concept exploits (3)

• yohannslm/CVE-2025-543521★ · 2025-07-29
• limmmw/CVE-2025-54352
• mufasa-noir/XML-RPC-Pingback-Vulnerability

References

• CVE Record
• NVD entry

Related

• CVE-2025-54939
• CVE-2026-23869
• CVE-2025-5435
• CVE-2025-5436
• CVE-2025-5434
• CVE-2025-54365