CVE-2026-66666: WordPress Core <= 7.1.2 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Other sources
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress wordpress allows Retrieve Embedded Sensitive Data.This issue affects WordPress: from n/a through 7.1.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 7.1.3
Event History
Frequently Asked Questions
Which WordPress installations are affected?
The issue affects Automattic WordPress versions through 7.1.2. The available data does not identify a lower affected version boundary.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact if exploited?
The reported impact is disclosure of embedded sensitive data. The CVSS vector indicates low impact to confidentiality and no stated impact to integrity or availability.