WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability (WordPress WordPress)

CVE-2025-58246
MEDIUM 4.3

En bref

Source
NVD
EPSS
EPSS 0.27 % · centile 20 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Patchstack
Statut NVD
Deferred

Description

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

Faiblesses (CWE)

  • CWE-201 — Insertion of Sensitive Information Into Sent Data

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NPatchstack
CVSS 3.1MEDIUM 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NNVD · audit@patchstack.com (Secondary)

Références européennes

Produits affectés

ProduitVersions
WordPress · WordPressaffected 6.8 ≤ 6.8.2 ; affected 6.7 ≤ 6.7.3 ; affected 6.6 ≤ 6.6.3 ; affected 6.5 ≤ 6.5.6 ; affected 6.4 ≤ 6.4.6 ; affected 6.3 ≤ 6.3.6

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD