WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments



Description
Props to Carolina Nymark for discovering an issue where comments from password-protected posts and pages could be displayed under certain conditions.

Affects WordPresses

fixed in version 5.4.2
fixed in version 5.4.2
fixed in version 5.3.4
fixed in version 5.3.4
fixed in version 5.3.4
fixed in version 5.3.4
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.2.7
fixed in version 5.1.6
fixed in version 5.1.6
fixed in version 5.1.6
fixed in version 5.1.6
fixed in version 5.1.6
fixed in version 5.1.6
fixed in version 5.0.10
fixed in version 5.0.10
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.9.15
fixed in version 4.8.14
fixed in version 4.8.14
fixed in version 4.8.14
fixed in version 4.8.14
fixed in version 4.8.14
fixed in version 4.8.14
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.7.18
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.6.19
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.5.22
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.4.23
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.3.24
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.2.28
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.1.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 4.0.31
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.9.32
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.8.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34
fixed in version 3.7.34

References

URL https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
URL https://github.com/WordPress/WordPress/commit/c075eec24f2f3214ab0d0fb0120a23082e6b1122

Classification

Type SENSITIVE DATA DISCLOSURE
OWASP Top 10 A3: Sensitive Data Exposure

Miscellaneous

Original Researcher Carolina Nymark
Views 2560
Verified No
WPVDB ID 10268

Timeline

Publicly Published 2020-06-11 (28 days ago)
Added 2020-06-11 (28 days ago)
Last Updated 2020-06-12 (27 days ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin