Quick answers
- Is CVE-2026-66666 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66666 being exploited in the wild.
- How severe is CVE-2026-66666?
- Informational severity, published 6 October 2026.
- Which products and versions are affected?
- Automattic WordPress through 7.1.2.
- Is there a fix for CVE-2026-66666?
- Yes: fixed in WordPress 7.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66666 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-66666?
- Check whether you run Automattic WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: WordPress 7.1.3
Technical details
A sensitive data exposure vulnerability in WordPress allows an unauthenticated attacker to retrieve embedded sensitive information transmitted by the application. The vulnerability affects WordPress versions up to 7.1.2 and requires no authentication or special privileges. The attack vector is network-based, and remediation is available in version 7.1.3 and later.
Affected products
- Automattic WordPress through 7.1.2
Timeline
- 2026-09-21: disclosed: Reported by Ananda Dhakal
- 2026-10-06: advisory: Published by Patchstack