CVE-2025-58246
Full vulnerability record from the local CVENow database.
Description
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-09-23 18:15:37.660000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-58246",
"sourceIdentifier": "[email protected]",
"published": "2025-09-23T18:15:37.660",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."
},
{
"lang": "es",
"value": "La vulnerabilidad de inserción de información sensible en datos enviados en WordPress permite recuperar datos sensibles incrustados. El equipo de seguridad del núcleo de WordPress está al tanto del problema y ya está trabajando en una solución. Esta es una vulnerabilidad de baja gravedad. Se requieren privilegios de nivel de colaborador para explotarla.\nEste problema afecta a WordPress: desde 6.8 hasta 6.8.2, desde 6.7 hasta 6.7.3, desde 6.6 hasta 6.6.3, desde 6.5 hasta 6.5.6, desde 6.4 hasta 6.4.6, desde 6.3 hasta 6.3.6, desde 6.2 hasta 6.2.7, desde 6.1 hasta 6.1.8, desde 6.0 hasta 6.0.10, desde 5.9 hasta 5.9.11, desde 5.8 hasta 5.8.11, desde 5.7 hasta 5.7.13, desde 5.6 hasta 5.6.15, desde 5.5 hasta 5.5.16, desde 5.4 hasta 5.4.17, desde 5.3 hasta 5.3.19, desde 5.2 hasta 5.2.22, desde 5.1 hasta 5.1.20, desde 5.0 hasta 5.0.23, desde 4.9 hasta 4.9.27, desde 4.8 hasta 4.8.26, desde 4.7 hasta 4.7.30."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "WordPress",
"product": "WordPress",
"defaultStatus": "unaffected",
"repo": "https://github.com/WordPress/WordPress",
"versions": [
{
"version": "6.8",
"lessThanOrEqual": "6.8.2",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.8.3",
"status": "unaffected"
}
]
},
{
"version": "6.7",
"lessThanOrEqual": "6.7.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.7.4",
"status": "unaffected"
}
]
},
{
"version": "6.6",
"lessThanOrEqual": "6.6.3",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.6.4",
"status": "unaffected"
}
]
},
{
"version": "6.5",
"lessThanOrEqual": "6.5.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.5.7",
"status": "unaffected"
}
]
},
{
"version": "6.4",
"lessThanOrEqual": "6.4.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.4.7",
"status": "unaffected"
}
]
},
{
"version": "6.3",
"lessThanOrEqual": "6.3.6",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.3.7",
"status": "unaffected"
}
]
},
{
"version": "6.2",
"lessThanOrEqual": "6.2.7",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.2.8",
"status": "unaffected"
}
]
},
{
"version": "6.1",
"lessThanOrEqual": "6.1.8",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.1.9",
"status": "unaffected"
}
]
},
{
"version": "6.0",
"lessThanOrEqual": "6.0.10",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "6.0.11",
"status": "unaffected"
}
]
},
{
"version": "5.9",
"lessThanOrEqual": "5.9.11",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.9.12",
"status": "unaffected"
}
]
},
{
"version": "5.8",
"lessThanOrEqual": "5.8.11",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.8.12",
"status": "unaffected"
}
]
},
{
"version": "5.7",
"lessThanOrEqual": "5.7.13",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.7.14",
"status": "unaffected"
}
]
},
{
"version": "5.6",
"lessThanOrEqual": "5.6.15",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.6.16",
"status": "unaffected"
}
]
},
{
"version": "5.5",
"lessThanOrEqual": "5.5.16",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.5.17",
"status": "unaffected"
}
]
},
{
"version": "5.4",
"lessThanOrEqual": "5.4.17",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.4.18",
"status": "unaffected"
}
]
},
{
"version": "5.3",
"lessThanOrEqual": "5.3.19",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.3.20",
"status": "unaffected"
}
]
},
{
"version": "5.2",
"lessThanOrEqual": "5.2.22",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.2.23",
"status": "unaffected"
}
]
},
{
"version": "5.1",
"lessThanOrEqual": "5.1.20",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.1.21",
"status": "unaffected"
}
]
},
{
"version": "5.0",
"lessThanOrEqual": "5.0.23",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "5.0.24",
"status": "unaffected"
}
]
},
{
"version": "4.9",
"lessThanOrEqual": "4.9.27",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.9.28",
"status": "unaffected"
}
]
},
{
"version": "4.8",
"lessThanOrEqual": "4.8.26",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.8.27",
"status": "unaffected"
}
]
},
{
"version": "4.7",
"lessThanOrEqual": "4.7.30",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "4.7.31",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T18:30:39.501670Z",
"id": "CVE-2025-58246",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve",
"source": "[email protected]"
},
{
"url": "https://wordpress.org/news/2025/09/wordpress-6-8-3-release/",
"source": "[email protected]"
}
]
}