CVE-2026-66666CWE-201

CVE-2026-66666

published October 6, 2026

CVSS
6.9
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.

This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-10-06T22:16Z
References (3)
https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve · [email protected]https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve · [email protected]https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ · [email protected]
EPSS history
Timeline
  • 08 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 06 OCT 17:48Z
    WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
    cvelistv5