cvelistv5 - CVE-2025-58246

CVE-2025-58246 (GCVE-0-2025-58246)

Vulnerability from cvelistv5

Published

2025-09-23 17:17

Modified

2025-10-01 08:37

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Summary

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.

References

URL

Tags

	audit@patchstack.com	https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve
	audit@patchstack.com	https://wordpress.org/news/2025/09/wordpress-6-8-3-release/

Impacted products

	Vendor	Product	Version
	WordPress	WordPress	Version: 6.8 < Version: 6.7 < Version: 6.6 < Version: 6.5 < Version: 6.4 < Version: 6.3 < Version: 6.2 < Version: 6.1 < Version: 6.0 < Version: 5.9 < Version: 5.8 < Version: 5.7 < Version: 5.6 < Version: 5.5 < Version: 5.4 < Version: 5.3 < Version: 5.2 < Version: 5.1 < Version: 5.0 < Version: 4.9 < Version: 4.8 < Version: 4.7 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-23T18:30:39.501670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-23T18:37:38.153Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WordPress",
          "repo": "https://github.com/WordPress/WordPress",
          "vendor": "WordPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.8.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.8.2",
              "status": "affected",
              "version": "6.8",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.7.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.7.3",
              "status": "affected",
              "version": "6.7",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.6.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.6.3",
              "status": "affected",
              "version": "6.6",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.5.7",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.5.6",
              "status": "affected",
              "version": "6.5",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.4.7",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.4.6",
              "status": "affected",
              "version": "6.4",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.3.7",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.3",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.2.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.2.7",
              "status": "affected",
              "version": "6.2",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.1.9",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.1.8",
              "status": "affected",
              "version": "6.1",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.0.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.10",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.9.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.9.11",
              "status": "affected",
              "version": "5.9",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.8.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.8.11",
              "status": "affected",
              "version": "5.8",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.7.14",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.7.13",
              "status": "affected",
              "version": "5.7",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.6.16",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.6.15",
              "status": "affected",
              "version": "5.6",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.5.17",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.5.16",
              "status": "affected",
              "version": "5.5",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.4.18",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.4.17",
              "status": "affected",
              "version": "5.4",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.3.20",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.3.19",
              "status": "affected",
              "version": "5.3",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.2.23",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.2.22",
              "status": "affected",
              "version": "5.2",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.1.21",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.1.20",
              "status": "affected",
              "version": "5.1",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.0.24",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.0.23",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.9.28",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.9.27",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.8.27",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.8.26",
              "status": "affected",
              "version": "4.8",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.7.31",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.7.30",
              "status": "affected",
              "version": "4.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Abu Hurayra (Patchstack Bug Bounty Program)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "John Blackbourn (WordPress core security team lead)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Timothy Jacobs"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Wilson"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mike Nelson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eInsertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T08:37:01.207Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."
            }
          ],
          "value": "Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress \u003c= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-58246",
    "datePublished": "2025-09-23T17:17:12.399Z",
    "dateReserved": "2025-08-27T16:19:44.959Z",
    "dateUpdated": "2025-10-01T08:37:01.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-58246\",\"sourceIdentifier\":\"audit@patchstack.com\",\"published\":\"2025-09-23T18:15:37.660\",\"lastModified\":\"2025-10-01T09:15:36.967\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"audit@patchstack.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]}],\"references\":[{\"url\":\"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve\",\"source\":\"audit@patchstack.com\"},{\"url\":\"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/\",\"source\":\"audit@patchstack.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-58246\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-23T18:30:39.501670Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-23T18:30:41.999Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"WordPress \u003c= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Abu Hurayra (Patchstack Bug Bounty Program)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"John Blackbourn (WordPress core security team lead)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Timothy Jacobs\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Wilson\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Mike Nelson\"}], \"impacts\": [{\"capecId\": \"CAPEC-37\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-37 Retrieve Embedded Sensitive Data\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/WordPress/WordPress\", \"vendor\": \"WordPress\", \"product\": \"WordPress\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"6.8.3\", \"status\": \"unaffected\"}], \"version\": \"6.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.8.2\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.7.4\", \"status\": \"unaffected\"}], \"version\": \"6.7\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7.3\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.6.4\", \"status\": \"unaffected\"}], \"version\": \"6.6\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.3\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.5.7\", \"status\": \"unaffected\"}], \"version\": \"6.5\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.5.6\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.4.7\", \"status\": \"unaffected\"}], \"version\": \"6.4\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.4.6\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.3.7\", \"status\": \"unaffected\"}], \"version\": \"6.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.3.6\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.2.8\", \"status\": \"unaffected\"}], \"version\": \"6.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.2.7\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.1.9\", \"status\": \"unaffected\"}], \"version\": \"6.1\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.8\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.0.11\", \"status\": \"unaffected\"}], \"version\": \"6.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.0.10\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.9.12\", \"status\": \"unaffected\"}], \"version\": \"5.9\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.9.11\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.8.12\", \"status\": \"unaffected\"}], \"version\": \"5.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.8.11\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.7.14\", \"status\": \"unaffected\"}], \"version\": \"5.7\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.7.13\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.6.16\", \"status\": \"unaffected\"}], \"version\": \"5.6\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.6.15\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.5.17\", \"status\": \"unaffected\"}], \"version\": \"5.5\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.5.16\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.4.18\", \"status\": \"unaffected\"}], \"version\": \"5.4\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.4.17\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.3.20\", \"status\": \"unaffected\"}], \"version\": \"5.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.3.19\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.2.23\", \"status\": \"unaffected\"}], \"version\": \"5.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.2.22\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.1.21\", \"status\": \"unaffected\"}], \"version\": \"5.1\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.1.20\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"5.0.24\", \"status\": \"unaffected\"}], \"version\": \"5.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.0.23\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.9.28\", \"status\": \"unaffected\"}], \"version\": \"4.9\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.9.27\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.8.27\", \"status\": \"unaffected\"}], \"version\": \"4.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.8.26\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.7.31\", \"status\": \"unaffected\"}], \"version\": \"4.7\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.7.30\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update WordPress to one of the following patched or higher versions: 6.8.3, 6.7.4, 6.6.4, 6.5.7, 6.4.7, 6.3.7, 6.2.8, 6.1.9, 6.0.11, 5.9.12, 5.8.12, 5.7.14, 5.6.16, 5.5.17, 5.4.18, 5.3.20, 5.2.23, 5.1.21, 5.0.24, 4.9.28, 4.8.27, or 4.7.31.\", \"base64\": false}]}], \"references\": [{\"url\": \"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://wordpress.org/news/2025/09/wordpress-6-8-3-release/\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eInsertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201 Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"shortName\": \"Patchstack\", \"dateUpdated\": \"2025-10-01T08:37:01.207Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-58246\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T08:37:01.207Z\", \"dateReserved\": \"2025-08-27T16:19:44.959Z\", \"assignerOrgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"datePublished\": \"2025-09-23T17:17:12.399Z\", \"assignerShortName\": \"Patchstack\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

wid-sec-w-2025-2115

Vulnerability from csaf_certbund

Published

2025-09-23 22:00

Modified

2025-12-21 23:00

Summary

WordPress Core: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

WordPress ist ein PHP basiertes Open Source Blog-System.

Angriff

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in WordPress Core ausnutzen, um Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "WordPress ist ein PHP basiertes Open Source Blog-System.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in WordPress Core ausnutzen, um Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2115 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2115.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2115 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2115"
      },
      {
        "category": "external",
        "summary": "Wordpress Vulnerability Database vom 2025-09-23",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-682-authenticated-author-stored-cross-site-scripting-2"
      },
      {
        "category": "external",
        "summary": "Wordpress Vulnerability Database vom 2025-09-23",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-682-authenticated-contributor-sensitive-information-exposure"
      },
      {
        "category": "external",
        "summary": "Patchstack Vulnerability Database vom 2025-09-23",
        "url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability"
      },
      {
        "category": "external",
        "summary": "Patchstack Vulnerability Database vom 2025-09-23",
        "url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4358 vom 2025-11-03",
        "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00001.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6075 vom 2025-12-10",
        "url": "https://lists.debian.org/debian-security-announce/2025/msg00241.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6091 vom 2025-12-21",
        "url": "https://lists.debian.org/debian-security-announce/2025/msg00256.html"
      }
    ],
    "source_lang": "en-US",
    "title": "WordPress Core: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-12-21T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-22T08:55:03.361+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2115",
      "initial_release_date": "2025-09-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-09-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-11-02T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2025-12-09T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2025-12-21T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=6.8.2",
                "product": {
                  "name": "Open Source WordPress \u003c=6.8.2",
                  "product_id": "T047148"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=6.8.2",
                "product": {
                  "name": "Open Source WordPress \u003c=6.8.2",
                  "product_id": "T047148-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "WordPress"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-58246",
      "product_status": {
        "known_affected": [
          "2951"
        ],
        "last_affected": [
          "T047148"
        ]
      },
      "release_date": "2025-09-23T22:00:00.000+00:00",
      "title": "CVE-2025-58246"
    },
    {
      "cve": "CVE-2025-58674",
      "product_status": {
        "known_affected": [
          "2951"
        ],
        "last_affected": [
          "T047148"
        ]
      },
      "release_date": "2025-09-23T22:00:00.000+00:00",
      "title": "CVE-2025-58674"
    }
  ]
}

ghsa-9cxg-grmq-54mq

Vulnerability from github

Published

2025-09-23 18:30

Modified

2025-10-01 09:30

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.

The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from n/a through 6.8.2

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-58246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-23T18:15:37Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\n\nThe WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from n/a through 6.8.2",
  "id": "GHSA-9cxg-grmq-54mq",
  "modified": "2025-10-01T09:30:24Z",
  "published": "2025-09-23T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58246"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/news/2025/09/wordpress-6-8-3-release"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

fkie_cve-2025-58246

Vulnerability from fkie_nvd

Published

2025-09-23 18:15

Modified

2025-10-01 09:15

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	audit@patchstack.com	https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve
	audit@patchstack.com	https://wordpress.org/news/2025/09/wordpress-6-8-3-release/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it.\nThis issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30."
    }
  ],
  "id": "CVE-2025-58246",
  "lastModified": "2025-10-01T09:15:36.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "audit@patchstack.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-09-23T18:15:37.660",
  "references": [
    {
      "source": "audit@patchstack.com",
      "url": "https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability?_s_id=cve"
    },
    {
      "source": "audit@patchstack.com",
      "url": "https://wordpress.org/news/2025/09/wordpress-6-8-3-release/"
    }
  ],
  "sourceIdentifier": "audit@patchstack.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "audit@patchstack.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-58246 (GCVE-0-2025-58246)

Vulnerability from cvelistv5

wid-sec-w-2025-2115

Vulnerability from csaf_certbund

ghsa-9cxg-grmq-54mq

Vulnerability from github

fkie_cve-2025-58246

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature