{"id":"CVE-2025-58246","state":"PUBLISHED","title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","description":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.","publishedAt":"2025-09-23T17:17:12.399Z","updatedAt":"2026-04-28T16:13:42.821Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"Patchstack"},"assigner":"Patchstack","products":["WordPress WordPress"],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"6.8","status":"affected","lessThanOrEqual":"6.8.2","changes":[{"at":"6.8.3","status":"unaffected"}],"versionType":"custom"},{"version":"6.7","status":"affected","lessThanOrEqual":"6.7.3","changes":[{"at":"6.7.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.6","status":"affected","lessThanOrEqual":"6.6.3","changes":[{"at":"6.6.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.5","status":"affected","lessThanOrEqual":"6.5.6","changes":[{"at":"6.5.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.4","status":"affected","lessThanOrEqual":"6.4.6","changes":[{"at":"6.4.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.3","status":"affected","lessThanOrEqual":"6.3.6","changes":[{"at":"6.3.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.2","status":"affected","lessThanOrEqual":"6.2.7","changes":[{"at":"6.2.8","status":"unaffected"}],"versionType":"custom"},{"version":"6.1","status":"affected","lessThanOrEqual":"6.1.8","changes":[{"at":"6.1.9","status":"unaffected"}],"versionType":"custom"},{"version":"6.0","status":"affected","lessThanOrEqual":"6.0.10","changes":[{"at":"6.0.11","status":"unaffected"}],"versionType":"custom"},{"version":"5.9","status":"affected","lessThanOrEqual":"5.9.11","changes":[{"at":"5.9.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.8","status":"affected","lessThanOrEqual":"5.8.11","changes":[{"at":"5.8.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.7","status":"affected","lessThanOrEqual":"5.7.13","changes":[{"at":"5.7.14","status":"unaffected"}],"versionType":"custom"},{"version":"5.6","status":"affected","lessThanOrEqual":"5.6.15","changes":[{"at":"5.6.16","status":"unaffected"}],"versionType":"custom"},{"version":"5.5","status":"affected","lessThanOrEqual":"5.5.16","changes":[{"at":"5.5.17","status":"unaffected"}],"versionType":"custom"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4.17","changes":[{"at":"5.4.18","status":"unaffected"}],"versionType":"custom"},{"version":"5.3","status":"affected","lessThanOrEqual":"5.3.19","changes":[{"at":"5.3.20","status":"unaffected"}],"versionType":"custom"},{"version":"5.2","status":"affected","lessThanOrEqual":"5.2.22","changes":[{"at":"5.2.23","status":"unaffected"}],"versionType":"custom"},{"version":"5.1","status":"affected","lessThanOrEqual":"5.1.20","changes":[{"at":"5.1.21","status":"unaffected"}],"versionType":"custom"},{"version":"5.0","status":"affected","lessThanOrEqual":"5.0.23","changes":[{"at":"5.0.24","status":"unaffected"}],"versionType":"custom"},{"version":"4.9","status":"affected","lessThanOrEqual":"4.9.27","changes":[{"at":"4.9.28","status":"unaffected"}],"versionType":"custom"},{"version":"4.8","status":"affected","lessThanOrEqual":"4.8.26","changes":[{"at":"4.8.27","status":"unaffected"}],"versionType":"custom"},{"version":"4.7","status":"affected","lessThanOrEqual":"4.7.30","changes":[{"at":"4.7.31","status":"unaffected"}],"versionType":"custom"}],"repo":"https://github.com/WordPress/WordPress"}],"references":["https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"],"weaknesses":["CWE-201"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/58xxx/CVE-2025-58246.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-58246","state":"PUBLISHED","datePublished":"2025-09-23T17:17:12.399Z","dateUpdated":"2026-04-28T16:13:42.821Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2025-08-27T16:19:44.959Z"},"containers":{"cna":{"title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."}],"affected":[{"vendor":"WordPress","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"6.8","status":"affected","lessThanOrEqual":"6.8.2","changes":[{"at":"6.8.3","status":"unaffected"}],"versionType":"custom"},{"version":"6.7","status":"affected","lessThanOrEqual":"6.7.3","changes":[{"at":"6.7.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.6","status":"affected","lessThanOrEqual":"6.6.3","changes":[{"at":"6.6.4","status":"unaffected"}],"versionType":"custom"},{"version":"6.5","status":"affected","lessThanOrEqual":"6.5.6","changes":[{"at":"6.5.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.4","status":"affected","lessThanOrEqual":"6.4.6","changes":[{"at":"6.4.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.3","status":"affected","lessThanOrEqual":"6.3.6","changes":[{"at":"6.3.7","status":"unaffected"}],"versionType":"custom"},{"version":"6.2","status":"affected","lessThanOrEqual":"6.2.7","changes":[{"at":"6.2.8","status":"unaffected"}],"versionType":"custom"},{"version":"6.1","status":"affected","lessThanOrEqual":"6.1.8","changes":[{"at":"6.1.9","status":"unaffected"}],"versionType":"custom"},{"version":"6.0","status":"affected","lessThanOrEqual":"6.0.10","changes":[{"at":"6.0.11","status":"unaffected"}],"versionType":"custom"},{"version":"5.9","status":"affected","lessThanOrEqual":"5.9.11","changes":[{"at":"5.9.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.8","status":"affected","lessThanOrEqual":"5.8.11","changes":[{"at":"5.8.12","status":"unaffected"}],"versionType":"custom"},{"version":"5.7","status":"affected","lessThanOrEqual":"5.7.13","changes":[{"at":"5.7.14","status":"unaffected"}],"versionType":"custom"},{"version":"5.6","status":"affected","lessThanOrEqual":"5.6.15","changes":[{"at":"5.6.16","status":"unaffected"}],"versionType":"custom"},{"version":"5.5","status":"affected","lessThanOrEqual":"5.5.16","changes":[{"at":"5.5.17","status":"unaffected"}],"versionType":"custom"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4.17","changes":[{"at":"5.4.18","status":"unaffected"}],"versionType":"custom"},{"version":"5.3","status":"affected","lessThanOrEqual":"5.3.19","changes":[{"at":"5.3.20","status":"unaffected"}],"versionType":"custom"},{"version":"5.2","status":"affected","lessThanOrEqual":"5.2.22","changes":[{"at":"5.2.23","status":"unaffected"}],"versionType":"custom"},{"version":"5.1","status":"affected","lessThanOrEqual":"5.1.20","changes":[{"at":"5.1.21","status":"unaffected"}],"versionType":"custom"},{"version":"5.0","status":"affected","lessThanOrEqual":"5.0.23","changes":[{"at":"5.0.24","status":"unaffected"}],"versionType":"custom"},{"version":"4.9","status":"affected","lessThanOrEqual":"4.9.27","changes":[{"at":"4.9.28","status":"unaffected"}],"versionType":"custom"},{"version":"4.8","status":"affected","lessThanOrEqual":"4.8.26","changes":[{"at":"4.8.27","status":"unaffected"}],"versionType":"custom"},{"version":"4.7","status":"affected","lessThanOrEqual":"4.7.30","changes":[{"at":"4.7.31","status":"unaffected"}],"versionType":"custom"}],"repo":"https://github.com/WordPress/WordPress"}],"references":[{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/","tags":["release-notes"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"CWE-201 Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:13:42.821Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Abu Hurayra (Patchstack Bug Bounty Program)"},{"lang":"en","type":"coordinator","value":"John Blackbourn (WordPress core security team lead)"},{"lang":"en","type":"reporter","value":"Timothy Jacobs"},{"lang":"en","type":"reporter","value":"Peter Wilson"},{"lang":"en","type":"reporter","value":"Mike Nelson"}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-23T18:30:39.501670Z","id":"CVE-2025-58246","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-23T18:37:38.153Z"}}]}}}