What the vulnerability does
01Description
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.
This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress versions 6.8 through 6.8.2 contain an information disclosure vulnerability that allows authenticated users with low privileges to read sensitive data they should not have access to. The vulnerability requires network access and valid login credentials but no additional user interaction. Site administrators should update to a version newer than 6.8.2 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible only to higher-privileged users.
Potential impact on your site
04Site Impact
Authenticated users can access confidential data beyond their permission level, risking exposure of private site information.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
06Disclosure timeline
September 23, 2025
CVE published
April 28, 2026
Record updated
