CVE-2025-58246: Automattic WordPress · Insertion of Sensitive Information Into Sent Data
Affects Automattic WordPressSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Automattic WordPress | Affected
| Fixed in– |
AI-suggested
European organizations should implement the following specific mitigation measures: 1) Restrict contributor-level privileges strictly to trusted users and regularly audit user roles and permissions to minimize the number of accounts with such access. 2) Monitor WordPress core updates closely and apply security patches promptly once the fix for CVE-2025-58246 is released. 3) Employ web application firewalls (WAFs) with custom rules to detect and block suspicious activities from contributor accounts that attempt to access or extract sensitive embedded data. 4) Conduct regular security assessments and penetration tests focusing on privilege escalation and data leakage scenarios within WordPress environments. 5) Implement logging and alerting on sensitive data access patterns to detect potential exploitation attempts early. 6) Educate content contributors about security best practices and the importance of safeguarding their credentials to prevent unauthorized access. 7) Consider deploying additional data encryption or tokenization mechanisms for sensitive data embedded in sent content to reduce exposure risk.
Description
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.