[CVE-2025-54352] WordPress XML-RPC Pingback Leaks Titles of Private and Draft Posts

TL;DR
WordPress versions 3.5 through 6.8.2 allow anyone on the internet to infer the titles of private and draft posts by abusing the pingback.ping XML-RPC method. Each request answers yes or no to a chosen substring so the attacker can rebuild the entire headline in minutes. WordPress 6.8.3 disables the behaviour and administrators can mitigate immediately by blocking or disabling XML-RPC pingbacks.

1. Summary

The vulnerability breaks the assumption that unpublished WordPress content remains invisible. Because many organisations stage announcements, earnings reports and vulnerability write-ups as private drafts, the flaw enables premature disclosure or spear-phishing preparation.

2. Context - Why XML-RPC still matters in 2025

XML-RPC predates WordPress itself but remains enabled for backwards compatibility with desktop editors, mobile apps and integration plugins. Even administrators who switched to the modern REST API often leave xmlrpc.php accessible because disabling it historically broke Jetpack and other popular extensions. Attackers therefore continue to probe the endpoint for well-worn classics such as brute-force logins, pingback DDoS reflection and now title inference.

A single URL, usually https://example.com/xmlrpc.php, surfaces on every publicly reachable WordPress instance unless the owner has actively blocked or removed it.

3. Technical Details - Binary search through pingback errors

pingback.ping takes a source URL and a target URL. If the target is a valid WordPress post the method returns success. Imperva researchers discovered that the implementation checks the target string against all posts, including drafts and privates, before enforcing permissions. Crucially, the function returns different fault codes depending on whether the supplied URL matches an existing post slug.

Because slugs are generated from titles, an attacker can send crafted URLs containing partial guesses:

<?xml version="1.0"?>
<methodCall>
  <methodName>pingback.ping</methodName>
  <params>
    <param><value><string>https://attacker.example/a</string></value></param>
    <param><value><string>https://victim.example/2025/07/21/ann</string></value></param>
  </params>
</methodCall>

If any unpublished post begins with “ann” the server returns fault code 32 (target already linked). A negative answer returns code 33 (no such post). By iterating through the alphabet and applying a binary search the attacker recovers the complete slug and, by proxy, the full headline. The process is fully unauthenticated, scriptable and fast because each request is lightweight.

WordPress 6.8.3 patches the logic so that the lookup only occurs on publicly viewable posts. Legacy sites that rely on XML-RPC but not on pingbacks can add the following filter immediately:

add_filter( 'xmlrpc_methods', function( $methods ) {
    unset( $methods['pingback.ping'] );
    return $methods;
} );

4. Impact - From confidential product launches to targeted extortion

While only the post titles leak, headlines often reveal the essence of an article. A private post titled “Security Breach Post-Mortem Q3” telegraphs an incident before public disclosure. Marketing drafts can tip competitors, and unpublished vulnerability advisories can give attackers a head start. The risk scales with the sensitivity of the editorial calendar, which is why Volerion places the issue in the high band despite a CVSS base score of 7.5.

Attackers can also abuse the information for social engineering. Knowledge that a company is preparing “Board Meeting Minutes 28 July” helps phishing emails bypass suspicion.

5. Remediation - Practical steps

Upgrade WordPress core to 6.8.3 or later. Managed hosting providers such as WordPress.com, WP Engine and Kinsta had rolled out the update within hours of disclosure.

Where an immediate upgrade is impossible:

• Disable pingbacks by removing or filtering pingback.ping as shown above.
• Restrict access to xmlrpc.php in the web server configuration or via a security plugin.
• Consider moving integrations to the REST API which is not affected by this issue.

Tests should confirm that legitimate services no longer rely on pingbacks before blocking the method outright.

6. Timeline

7. References

• Imperva Research Blog: https://www.imperva.com/blog/beware-a-threat-actor-could-steal-the-titles-of-your-private-and-draft-wordpress-posts/
• MITRE CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54352

About Volerion

Volerion delivers AI-driven enrichment minutes after a CVE goes live. A single call to our REST API returns CVSS 4.0 vectors, exploitability metrics and affected products complete with remediation. Additionally, we offer different scoring profiles, complete with insight into the eight comprehensive categories that make up the final score. Our API is also available in the tradditional NVD API 2.0 format, so integration is as simple as swapping hosts. Spend less time parsing CVEs and more time closing them.

How the Volerion Risk Score Fits With CVSS, EPSS and KEV

At the time of writing:

• This CVE is scored at 7.5 using CVSS 3.1 which highlights high confidentiality impact and low attack complexity.
• EPSS currently assigns a score of 0.0 because telemetry is still catching up to the fresh disclosure.
• The vulnerability has not been added to CISA’s Known Exploited Vulnerabilities catalog.

The Volerion Risk Score pulls these signals together and layers them with additional factors such as affected product prevalence, exploit maturity and remediation effort. For CVE-2025-54352 the score is 8.7 which places it firmly in our high-risk band even though neither EPSS nor KEV yet reflect active exploitation.