CVE-2026-62088: WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data.
This issue affects ElasticPress: from n/a through 5.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ElasticPressto a version that resolves this vulnerability.Fixed in 5.3.5
Event History
Frequently Asked Questions
Who can exploit this issue?
The available data indicates it is remotely exploitable with no authentication or user interaction required. An attacker would need network access to a reachable affected ElasticPress deployment.
What is the potential impact?
The issue may allow retrieval of embedded sensitive data. The provided severity vector indicates low confidentiality impact, with no stated integrity or availability impact.
Which versions are affected?
ElasticPress versions through 5.3.4 are affected. The lower bound is listed as unspecified.