CVE-2025-54352

—

CVSS 3.1

3.7 low

EPSS

<1%p25

Published

Jul 21, 2025 (Jul 21, 2025)

Modified

Jun 17, 2026

Description

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.

Ecosystems: WordPress
Weakness: CWE-669
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.