CVE-2026-66666: CWE-201 Insertion of Sensitive Information Into Sent Data in Automattic WordPress

This vulnerability in Automattic WordPress allows an attacker to insert sensitive information into data sent by the application, which can then be retrieved. The affected versions include WordPress versions from 6.6 up to but not including 6.6.10, 6.7 up to but not including 6.7.10, 6.8 up to but not including 6.8.11, 6.9 up to but not including 6.9.10, 7.0 up to but not including 7.0.7, and 7.1 up to but not including 7.1.3. The vulnerability has a CVSS 4.0 base score of 6.9, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No vendor advisory or patch information is provided in the source data.

The vulnerability allows unauthorized retrieval of embedded sensitive data from WordPress installations running affected versions. This could lead to exposure of sensitive information, but the impact is rated medium due to the low confidentiality impact and no requirement for privileges or user interaction. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory content is provided, users should monitor Automattic's official channels for updates and apply any released patches promptly once available.