Vulnerability in Automattic WordPress

[ Description ]Official description

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund6 Oct 2026WID-SEC-2026-3769

  WordPress: Multiple vulnerabilities Translated from German

  CVE-2026-66666

[ References ]References

• patchstack.com/articles/wordpress-7-1-3-security-release
• patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress…
• wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release