CVE-2026-66666 Information disclosure in WordPress
Unauthenticated attackers can access sensitive comment data from private and unpublished posts via the comment feed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66666?
CVE-2026-66666 is a medium-severity vulnerability in Automattic WordPress, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Weakness: CWE-201
Which versions are affected by CVE-2026-66666?
How do I fix CVE-2026-66666?
Upgrade to a fixed version.
Is CVE-2026-66666 being exploited?
There is no known exploitation of CVE-2026-66666 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-66666, GHSA-vxpf-4h6r-qjx4, UBUNTU-CVE-2026-66666.