CVE-2017-6514: WordPress

Medium severity, CVSS 5.3. EPSS: 3% chance of exploitation in the next 30 days.

WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.

Affected products

• WordPress WordPress: version 4.7.2 only

Published 2019-05-22. Last modified 2026-06-17.