Unauthenticated XML-RPC pingback timing oracle discloses non-public post titles and privacy-request email addresses

[justinsteven]

This issue is being posted to Trac for public discussion at the WordPress Security Team's explicit request.

The security team said to post this to Trac and to mention that "the Security Team recommended public discussion".

An unauthenticated user can perform a pingback for a non-public pingback-enabled post using regex matching on the post title. If there is a post which has a title that matches the regex, then WordPress sleeps for one second and performs an outbound HTTP request, even if the matching post is one that the unauthenticated user cannot read (e.g. draft, scheduled, and trashed posts). The timing differential and outbound HTTP request can be observed, allowing the user to do character-by-character enumeration of pingback-enabled post titles that the user should not have access to. Disclosure of the title of an unavailable post may have a confidentiality impact.

After submitting the report to the security team, we found that this pingback-enabled primitive was publicly discussed in ​Beware! A threat actor could steal the titles of your private (and draft) WordPress posts with this new vulnerability! by Imperva (2025).

An unauthenticated user can attempt to perform a pingback for a non-public non-pingback-enabled post using regex matching on the post title. If there is a post which has a title that matches the regex, WordPress does not explicitly sleep or perform an outbound HTTP request as it does in the case where the post is pingback-enabled. However, there is a divergence in code that is executed in the case where the regex matches a post title v.s the case where the regex does not match a post title. This codepath divergence creates a timing differential. The unauthenticated user can use multicall to perform many pingback attempts within one request, amplifying the timing differential.

This second primitive can be used to do time-based character-by-character enumeration of non-pingback-enabled post titles that the user should not have access to. Importantly, this includes user email addresses for which a data export or data erasure has been performed, as these processes create non-public non-pingback-enabled posts with the user's email address in the post title. This represents a confidentiality and privacy impact.

The original report is attached. The issue was discovered by GPT 5.6 Sol, and the report was written by GPT 5.6 Sol with human editing and validation. We have chosen to withhold publication of the proof of concept scripts for the time being.

This issue is being posted to Trac for public discussion at the WordPress Security Team's explicit request.