WordPress core: Unauthenticated post-slug enumeration in redirect_guess_404_permalink (bypass of the CVE-2023-5692 fix)

Presentation

WordPress is the open-source content management system that powers a large share of the web. Its canonical redirect feature guesses a matching post when a visitor hits a 404 URL and redirects to it.

HDW Sec found that the array form of the post_type query variable lets an unauthenticated visitor enumerate the slugs of hidden, non-public post types, restoring the disclosure that CVE-2023-5692 had closed for the single-value path. WordPress fixed it in the 7.0.3 security release and credited HDWSec.

Issue(s)

• The fix for CVE-2023-5692 restricted the 404-guess query to publicly viewable post types on the single-value code path.
• The array post_type[] branch computes its empty() guard on the filtered subset but builds the SQL WHERE clause from the raw, unfiltered query variable.
• An unauthenticated request mixing one viewable type with a hidden (exclude_from_search) but publicly queryable type passes the guard and queries the hidden type.
• A partial-slug 404 then 301-redirects to the hidden post’s canonical permalink, enumerating its slug. No authentication is required.

References

• WordPress 7.0.3 security release, 2026-08-06 (credited to HDWSec).
• Bypass of the CVE-2023-5692 fix. No dedicated CVE assigned as of publication.
• Affected code: src/wp-includes/canonical.php, redirect_guess_404_permalink() (array post_type branch).