CVE-2026-66435: Insertion of Sensitive Information Into Sent Data in Devin Walker WP Rollback

The vulnerability identified as CVE-2026-66435 affects the WP Rollback plugin for WordPress developed by Devin Walker. It allows an attacker to retrieve embedded sensitive information by exploiting the insertion of sensitive data into sent data. The affected versions are from the initial release up to version 3.1.2 inclusive. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, no user interaction, and impacts confidentiality but not integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information embedded in data sent by the WP Rollback plugin. This compromises confidentiality but does not affect integrity or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's communications for updates and apply any official patches once available.