Medium severity · published Oct 6, 2026
CVE-2026-66666
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WordPress · Automattic
7.1 through 7.1.2; 7.0 through 7.0.6; 6.9 through 6.9.9; 6.8 through 6.8.10; 6.7 through 6.7.9; 6.6 through 6.6.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66666
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66666
vdb-entry
https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve
release-notes
https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
related
https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve
More from WordPress
7.1
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability