CVE-2026-66666mediumCWE-201

CVE-2026-66666: falha de média gravidade em Automattic WordPress

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Publicada em 06 out 2026

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%

probabilidade de exploração

0.3%top 80% das CVEs

exploração observada

nãonenhuma fonte reporta

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Automattic · WordPress

CVEs relacionadas — Automattic WordPress

No mesmo produto, das mais perigosas para as menos.

CVE-2024-32111MEDIUMWordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityEPSS 0.5%CVE-2026-93485HIGHWordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%

Referências

https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/