Summary
The unauthenticated trackback-ping response discloses source and commenter IP information for non-public posts.
Affected Products
WordPress core 7.0.4; XML-RPC trackback ping retrieval.
Affected Scope
- Product
- WordPress
- Component
- XML-RPC trackback ping retrieval
- Affected function
- mt.getTrackbackPings(); post_id; trackback/comment source metadata
- Affected versions
- WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.
- Safe version
- No fixed version confirmed in the supplied material.
- CWE
- CWE-200; CWE-862
Technical Summary
The trackback lookup returns metadata for a post context without an effective public-read check on the parent object.
Prerequisites and Permissions
Unauthenticated access to XML-RPC with trackback functionality enabled; a non-public post with trackback data is required.
Affected Locations
wp-includes/class-wp-xmlrpc-server.php: mt.getTrackbackPings(); post_id and trackback metadata serialization.
Reproducible Proof
A controlled non-public post with a marker trackback returned the source metadata to an unauthenticated request.
Vulnerable Code
$post_id = (int) $args[&class="tok-comment">#39;post_id'];
return get_trackback_pings( $post_id );Severity
low
Technical Analysis
mt.getTrackbackPings() accepts a post identifier and returns trackback/comment records including source URL/IP-derived metadata without requiring the caller to prove visibility of the parent post.
Impact
Confidentiality impact: unauthenticated disclosure of trackback source metadata tied to non-public posts. No post-body disclosure is claimed.
Remediation
Require public visibility of the parent post and minimize source metadata in unauthenticated responses; add private/draft/pending feed and XML-RPC tests.
Timeline
- Published
- Advisory published
Credits
Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.