WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Summary

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

Timeline

1. Sep 23, 2025, 5:17 PM UTCCVE published
2. Sep 23, 2025, 6:30 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Apr 28, 2026, 4:13 PM UTCRecord last updated

Affected versions

• WordPress WordPress

  From 6.8 · through 6.8.2; From 6.7 · through 6.7.3; From 6.6 · through 6.6.3; From 6.5 · through 6.5.6; From 6.4 · through 6.4.6; From 6.3 · through 6.3.6; From 6.2 · through 6.2.7; From 6.1 · through 6.1.8; From 6.0 · through 6.0.10; From 5.9 · through 5.9.11; From 5.8 · through 5.8.11; From 5.7 · through 5.7.13; From 5.6 · through 5.6.15; From 5.5 · through 5.5.16; From 5.4 · through 5.4.17; From 5.3 · through 5.3.19; From 5.2 · through 5.2.22; From 5.1 · through 5.1.20; From 5.0 · through 5.0.23; From 4.9 · through 4.9.27; From 4.8 · through 4.8.26; From 4.7 · through 4.7.30

References 2