{"api_version":"1","generated_at":"2026-07-24T18:55:32+00:00","cve":"CVE-2025-58246","urls":{"html":"https://cve.report/CVE-2025-58246","api":"https://cve.report/api/cve/CVE-2025-58246.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-58246","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-58246"},"summary":{"title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","description":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.","state":"PUBLISHED","assigner":"Patchstack","published_at":"2025-09-23 18:15:37","updated_at":"2026-04-28 19:34:06"},"problem_types":["CWE-201","CWE-201 CWE-201 Insertion of Sensitive Information Into Sent Data"],"metrics":[{"version":"3.1","source":"audit@patchstack.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/","name":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/","refsource":"audit@patchstack.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","name":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","refsource":"audit@patchstack.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":""},{"url":"https://patchstack.com/database/Wordpress/Wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","name":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve","refsource":"MITRE","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58246","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58246","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.8 6.8.2 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.7 6.7.3 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.6 6.6.3 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.5 6.5.6 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.4 6.4.6 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.3 6.3.6 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.2 6.2.7 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.1 6.1.8 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 6.0 6.0.10 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.9 5.9.11 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.8 5.8.11 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.7 5.7.13 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.6 5.6.15 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.5 5.5.16 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.4 5.4.17 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.3 5.3.19 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.2 5.2.22 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.1 5.1.20 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 5.0 5.0.23 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 4.9 4.9.27 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 4.8 4.8.26 custom","platforms":[]},{"source":"CNA","vendor":"WordPress","product":"WordPress","version":"affected 4.7 4.7.30 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Abu Hurayra (Patchstack Bug Bounty Program)","lang":"en"},{"source":"CNA","value":"John Blackbourn (WordPress core security team lead)","lang":"en"},{"source":"CNA","value":"Timothy Jacobs","lang":"en"},{"source":"CNA","value":"Peter Wilson","lang":"en"},{"source":"CNA","value":"Mike Nelson","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"58246","cve":"CVE-2025-58246","epss":"0.000390000","percentile":"0.118490000","score_date":"2026-04-28","updated_at":"2026-04-29 00:07:40"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-58246","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-09-23T18:30:39.501670Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-09-23T18:37:38.153Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WordPress","repo":"https://github.com/WordPress/WordPress","vendor":"WordPress","versions":[{"changes":[{"at":"6.8.3","status":"unaffected"}],"lessThanOrEqual":"6.8.2","status":"affected","version":"6.8","versionType":"custom"},{"changes":[{"at":"6.7.4","status":"unaffected"}],"lessThanOrEqual":"6.7.3","status":"affected","version":"6.7","versionType":"custom"},{"changes":[{"at":"6.6.4","status":"unaffected"}],"lessThanOrEqual":"6.6.3","status":"affected","version":"6.6","versionType":"custom"},{"changes":[{"at":"6.5.7","status":"unaffected"}],"lessThanOrEqual":"6.5.6","status":"affected","version":"6.5","versionType":"custom"},{"changes":[{"at":"6.4.7","status":"unaffected"}],"lessThanOrEqual":"6.4.6","status":"affected","version":"6.4","versionType":"custom"},{"changes":[{"at":"6.3.7","status":"unaffected"}],"lessThanOrEqual":"6.3.6","status":"affected","version":"6.3","versionType":"custom"},{"changes":[{"at":"6.2.8","status":"unaffected"}],"lessThanOrEqual":"6.2.7","status":"affected","version":"6.2","versionType":"custom"},{"changes":[{"at":"6.1.9","status":"unaffected"}],"lessThanOrEqual":"6.1.8","status":"affected","version":"6.1","versionType":"custom"},{"changes":[{"at":"6.0.11","status":"unaffected"}],"lessThanOrEqual":"6.0.10","status":"affected","version":"6.0","versionType":"custom"},{"changes":[{"at":"5.9.12","status":"unaffected"}],"lessThanOrEqual":"5.9.11","status":"affected","version":"5.9","versionType":"custom"},{"changes":[{"at":"5.8.12","status":"unaffected"}],"lessThanOrEqual":"5.8.11","status":"affected","version":"5.8","versionType":"custom"},{"changes":[{"at":"5.7.14","status":"unaffected"}],"lessThanOrEqual":"5.7.13","status":"affected","version":"5.7","versionType":"custom"},{"changes":[{"at":"5.6.16","status":"unaffected"}],"lessThanOrEqual":"5.6.15","status":"affected","version":"5.6","versionType":"custom"},{"changes":[{"at":"5.5.17","status":"unaffected"}],"lessThanOrEqual":"5.5.16","status":"affected","version":"5.5","versionType":"custom"},{"changes":[{"at":"5.4.18","status":"unaffected"}],"lessThanOrEqual":"5.4.17","status":"affected","version":"5.4","versionType":"custom"},{"changes":[{"at":"5.3.20","status":"unaffected"}],"lessThanOrEqual":"5.3.19","status":"affected","version":"5.3","versionType":"custom"},{"changes":[{"at":"5.2.23","status":"unaffected"}],"lessThanOrEqual":"5.2.22","status":"affected","version":"5.2","versionType":"custom"},{"changes":[{"at":"5.1.21","status":"unaffected"}],"lessThanOrEqual":"5.1.20","status":"affected","version":"5.1","versionType":"custom"},{"changes":[{"at":"5.0.24","status":"unaffected"}],"lessThanOrEqual":"5.0.23","status":"affected","version":"5.0","versionType":"custom"},{"changes":[{"at":"4.9.28","status":"unaffected"}],"lessThanOrEqual":"4.9.27","status":"affected","version":"4.9","versionType":"custom"},{"changes":[{"at":"4.8.27","status":"unaffected"}],"lessThanOrEqual":"4.8.26","status":"affected","version":"4.8","versionType":"custom"},{"changes":[{"at":"4.7.31","status":"unaffected"}],"lessThanOrEqual":"4.7.30","status":"affected","version":"4.7","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Abu Hurayra (Patchstack Bug Bounty Program)"},{"lang":"en","type":"coordinator","value":"John Blackbourn (WordPress core security team lead)"},{"lang":"en","type":"reporter","value":"Timothy Jacobs"},{"lang":"en","type":"reporter","value":"Peter Wilson"},{"lang":"en","type":"reporter","value":"Mike Nelson"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.</span><br><p>This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.</p>"}],"value":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"CWE-201 Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-28T16:13:42.821Z","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack"},"references":[{"tags":["vdb-entry"],"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve"},{"tags":["release-notes"],"url":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","assignerShortName":"Patchstack","cveId":"CVE-2025-58246","datePublished":"2025-09-23T17:17:12.399Z","dateReserved":"2025-08-27T16:19:44.959Z","dateUpdated":"2026-04-28T16:13:42.821Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-09-23 18:15:37","lastModifiedDate":"2026-04-28 19:34:06","problem_types":["CWE-201","CWE-201 CWE-201 Insertion of Sensitive Information Into Sent Data"],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"58246","Ordinal":"1","Title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vuln","CVE":"CVE-2025-58246","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"58246","Ordinal":"1","NoteData":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.","Type":"Description","Title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vuln"}]}}}