# CVE-2026-66666: WordPress sensitive data exposure in transmitted data

Source: https://junglewise.ai/threats/cve-2026-66666-insertion-of-sensitive-information-into-sent-data-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-66666 · Severity: info · Published 2026-10-06

WordPress, a content management system powering millions of websites, contains a vulnerability that can expose sensitive information such as passwords, emails, or payment details when data is transmitted. An unauthenticated attacker can retrieve this embedded sensitive data without requiring special privileges, potentially leading to account takeovers or data theft.

Vendors: [Automattic](https://junglewise.ai/threats/vendors/automattic).

## Quick answers

**Is CVE-2026-66666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66666 being exploited in the wild.

**How severe is CVE-2026-66666?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Automattic WordPress through 7.1.2.

**Is there a fix for CVE-2026-66666?** Yes: fixed in WordPress 7.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66666 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-66666?** Check whether you run Automattic WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WordPress 7.1.3

## Technical details

A sensitive data exposure vulnerability in WordPress allows an unauthenticated attacker to retrieve embedded sensitive information transmitted by the application. The vulnerability affects WordPress versions up to 7.1.2 and requires no authentication or special privileges. The attack vector is network-based, and remediation is available in version 7.1.3 and later.

## Affected products

- Automattic WordPress through 7.1.2

## Timeline

- 2026-09-21: disclosed: Reported by Ananda Dhakal
- 2026-10-06: advisory: Published by Patchstack

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve)

## Related threats

- [WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in)