CVE-2026-66666: WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.8.12+dfsg1-0+deb13u1 - Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 7.1.3+dfsg1-1 - Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 6.8.12+dfsg1-0+deb13u1Fixed in 7.1.4+dfsg1-1 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 7.1.3
Event History
Frequently Asked Questions
Which WordPress installations are affected?
The issue affects Automattic WordPress versions through 7.1.2. The available data does not identify a lower affected version boundary.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact if exploited?
The reported impact is disclosure of embedded sensitive data. The CVSS vector indicates low impact to confidentiality and no stated impact to integrity or availability.