Skip to content
OpenAdvisories
Medium · 4.3 CVE-2025-58246 EUVD-2025-30913GHSA-9cxg-grmq-54mq

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Published Sep 23, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.
This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

Affected products

VendorProductAffectedFixed
WordPress WordPress 6.8 – ≤ 6.8.2, 6.7 – ≤ 6.7.3, 6.6 – ≤ 6.6.3, 6.5 – ≤ 6.5.6, 6.4 – ≤ 6.4.6, 6.3 – ≤ 6.3.6, 6.2 – ≤ 6.2.7, 6.1 – ≤ 6.1.8, 6.0 – ≤ 6.0.10, 5.9 – ≤ 5.9.11, 5.8 – ≤ 5.8.11, 5.7 – ≤ 5.7.13, 5.6 – ≤ 5.6.15, 5.5 – ≤ 5.5.16, 5.4 – ≤ 5.4.17, 5.3 – ≤ 5.3.19, 5.2 – ≤ 5.2.22, 5.1 – ≤ 5.1.20, 5.0 – ≤ 5.0.23, 4.9… —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wordpress 6.8.3+dfsg1-1 —
Debian 13 wordpress 6.8.3+dfsg1-0+deb13u1 DSA-6091-1
Debian 12 wordpress 6.1.9+dfsg1-0+deb12u1 DSA-6075-1
Debian 11 wordpress 5.7.14+dfsg1-0+deb11u1 DLA-4358-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wordpress No fix yet —
Ubuntu 26.04 LTS wordpress No fix yet —
Ubuntu 25.10 wordpress No fix yet —
Ubuntu 24.04 LTS wordpress No fix yet —
Ubuntu 22.04 LTS wordpress No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wordpress No fix yet —
Ubuntu 18.04 LTS wordpress No fix yet —
Ubuntu 16.04 LTS wordpress No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling wordpress-oci-entrypoint 6.8.3-r0 —

Advisories 4

References