{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-58246","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","state":"PUBLISHED","assignerShortName":"Patchstack","dateReserved":"2025-08-27T16:19:44.959Z","datePublished":"2025-09-23T17:17:12.399Z","dateUpdated":"2026-04-28T16:13:42.821Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WordPress","repo":"https://github.com/WordPress/WordPress","vendor":"WordPress","versions":[{"changes":[{"at":"6.8.3","status":"unaffected"}],"lessThanOrEqual":"6.8.2","status":"affected","version":"6.8","versionType":"custom"},{"changes":[{"at":"6.7.4","status":"unaffected"}],"lessThanOrEqual":"6.7.3","status":"affected","version":"6.7","versionType":"custom"},{"changes":[{"at":"6.6.4","status":"unaffected"}],"lessThanOrEqual":"6.6.3","status":"affected","version":"6.6","versionType":"custom"},{"changes":[{"at":"6.5.7","status":"unaffected"}],"lessThanOrEqual":"6.5.6","status":"affected","version":"6.5","versionType":"custom"},{"changes":[{"at":"6.4.7","status":"unaffected"}],"lessThanOrEqual":"6.4.6","status":"affected","version":"6.4","versionType":"custom"},{"changes":[{"at":"6.3.7","status":"unaffected"}],"lessThanOrEqual":"6.3.6","status":"affected","version":"6.3","versionType":"custom"},{"changes":[{"at":"6.2.8","status":"unaffected"}],"lessThanOrEqual":"6.2.7","status":"affected","version":"6.2","versionType":"custom"},{"changes":[{"at":"6.1.9","status":"unaffected"}],"lessThanOrEqual":"6.1.8","status":"affected","version":"6.1","versionType":"custom"},{"changes":[{"at":"6.0.11","status":"unaffected"}],"lessThanOrEqual":"6.0.10","status":"affected","version":"6.0","versionType":"custom"},{"changes":[{"at":"5.9.12","status":"unaffected"}],"lessThanOrEqual":"5.9.11","status":"affected","version":"5.9","versionType":"custom"},{"changes":[{"at":"5.8.12","status":"unaffected"}],"lessThanOrEqual":"5.8.11","status":"affected","version":"5.8","versionType":"custom"},{"changes":[{"at":"5.7.14","status":"unaffected"}],"lessThanOrEqual":"5.7.13","status":"affected","version":"5.7","versionType":"custom"},{"changes":[{"at":"5.6.16","status":"unaffected"}],"lessThanOrEqual":"5.6.15","status":"affected","version":"5.6","versionType":"custom"},{"changes":[{"at":"5.5.17","status":"unaffected"}],"lessThanOrEqual":"5.5.16","status":"affected","version":"5.5","versionType":"custom"},{"changes":[{"at":"5.4.18","status":"unaffected"}],"lessThanOrEqual":"5.4.17","status":"affected","version":"5.4","versionType":"custom"},{"changes":[{"at":"5.3.20","status":"unaffected"}],"lessThanOrEqual":"5.3.19","status":"affected","version":"5.3","versionType":"custom"},{"changes":[{"at":"5.2.23","status":"unaffected"}],"lessThanOrEqual":"5.2.22","status":"affected","version":"5.2","versionType":"custom"},{"changes":[{"at":"5.1.21","status":"unaffected"}],"lessThanOrEqual":"5.1.20","status":"affected","version":"5.1","versionType":"custom"},{"changes":[{"at":"5.0.24","status":"unaffected"}],"lessThanOrEqual":"5.0.23","status":"affected","version":"5.0","versionType":"custom"},{"changes":[{"at":"4.9.28","status":"unaffected"}],"lessThanOrEqual":"4.9.27","status":"affected","version":"4.9","versionType":"custom"},{"changes":[{"at":"4.8.27","status":"unaffected"}],"lessThanOrEqual":"4.8.26","status":"affected","version":"4.8","versionType":"custom"},{"changes":[{"at":"4.7.31","status":"unaffected"}],"lessThanOrEqual":"4.7.30","status":"affected","version":"4.7","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Abu Hurayra (Patchstack Bug Bounty Program)"},{"lang":"en","type":"coordinator","value":"John Blackbourn (WordPress core security team lead)"},{"lang":"en","type":"reporter","value":"Timothy Jacobs"},{"lang":"en","type":"reporter","value":"Peter Wilson"},{"lang":"en","type":"reporter","value":"Mike Nelson"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.</span><br><p>This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.</p>"}],"value":"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"CWE-201 Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack","dateUpdated":"2026-04-28T16:13:42.821Z"},"references":[{"tags":["vdb-entry"],"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve"},{"tags":["release-notes"],"url":"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"value":"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"title":"WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-23T18:30:39.501670Z","id":"CVE-2025-58246","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-09-23T18:37:38.153Z"}}]}}