Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This… (CVE-2026-66435)

CVE-2026-66435 describes a vulnerability in the WP Rollback plugin by Devin Walker, affecting versions up to 3.1.2. The flaw involves the insertion of sensitive information into data sent by the plugin, which can be retrieved by an attacker. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, impacting confidentiality but not integrity or availability.

The vulnerability allows an attacker to retrieve sensitive information embedded in data sent by the WP Rollback plugin, potentially exposing confidential data. There is no indication of impact on data integrity or system availability. The attack complexity is high, and no privileges or user interaction are required, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor the vendor's communications for updates and avoid exposing the plugin to untrusted networks until a fix is available.