low3.7
CVE-2025-54352
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.
Impact
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
Affected products
| Product | Affected versions |
|---|---|
| WordPress 3.5 | through 6.8.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.