CVE-2026-66666

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.

CVSS

No CVSS.

References

Link	Resource
https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve
https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve
https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/

Configurations

No configuration.

History

06 Oct 2026, 21:17

Type	Values Removed	Values Added
References		() https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve - () https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ -
Summary	~~(en) Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress wordpress allows Retrieve Embedded Sensitive Data.This issue affects WordPress: from n/a through 7.1.2.~~	(en) Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.

06 Oct 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-06 18:16

Updated : 2026-10-06 21:17

NVD link : CVE-2026-66666

Mitre link : CVE-2026-66666

CVE.ORG link : CVE-2026-66666

JSON object : View

Products Affected

No product.

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-66666", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66666", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T18:21:14.868038Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "audit@patchstack.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "audit@patchstack.com", "affectedData": [{"vendor": "Automattic", "product": "WordPress", "versions": [{"status": "affected", "changes": [{"at": "7.1.3", "status": "unaffected"}], "version": "7.1", "versionType": "custom", "lessThanOrEqual": "7.1.2"}, {"status": "affected", "changes": [{"at": "7.0.7", "status": "unaffected"}], "version": "7.0", "versionType": "custom", "lessThanOrEqual": "7.0.6"}, {"status": "affected", "changes": [{"at": "6.9.10", "status": "unaffected"}], "version": "6.9", "versionType": "custom", "lessThanOrEqual": "6.9.9"}, {"status": "affected", "changes": [{"at": "6.8.11", "status": "unaffected"}], "version": "6.8", "versionType": "custom", "lessThanOrEqual": "6.8.10"}, {"status": "affected", "changes": [{"at": "6.7.10", "status": "unaffected"}], "version": "6.7", "versionType": "custom", "lessThanOrEqual": "6.7.9"}, {"status": "affected", "changes": [{"at": "6.6.10", "status": "unaffected"}], "version": "6.6", "versionType": "custom", "lessThanOrEqual": "6.6.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-06T18:16:55.810", "references": [{"url": "https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve", "source": "audit@patchstack.com"}, {"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve", "source": "audit@patchstack.com"}, {"url": "https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/", "source": "audit@patchstack.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "audit@patchstack.com", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\n\nThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9."}], "lastModified": "2026-10-06T21:17:20.977", "sourceIdentifier": "audit@patchstack.com"}