WordPress CVE-2026-66666

The description does not name a specific feature, protocol, or configuration setting - it states only that the flaw allows retrieval of embedded sensitive data in WordPress versions through 7.1.2. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), there are no authentication, privilege, or user-interaction prerequisites, implying remote unauthenticated exploitation against affected WordPress deployments. The primary limiting factors are the low confidentiality impact (only certain embedded sensitive data is exposed, not full disclosure) and the unverified affected-version/component scope ('7.1.2' does not align with public WordPress core releases), which may narrow which real-world installations are actually vulnerable.

This is a moderate-severity information-disclosure issue (CVSS 4.0 base 6.9, CWE-201 Insertion of Sensitive Information Into Sent Data) that scores high on exploitability but low on impact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates it is remotely reachable, low-complexity, requires no privileges and no user interaction - so the barrier to triggering it is minimal. However, impact is constrained to low confidentiality only (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope/subsequent-system impact, meaning an attacker can retrieve some embedded sensitive data but cannot modify or disrupt the system. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or published exploit code - this tempers the real-world priority despite the easy-to-trigger vector. Note a data caveat: the entry labels the product as 'Automattic WordPress' core at version 'through 7.1.2', but public WordPress core releases are in the 6.x range, so the exact affected product/version should be verified with Patchstack/vendor before treating '7.1.2' as authoritative. Overall this is a 'patch in normal cycle' item rather than an emergency: easy to exploit but low-value payoff and no exploitation signal.

A remote, unauthenticated attacker sends a normal request to an affected WordPress instance and receives a response that embeds sensitive information the application should not have included. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are needed. No public exploit code is identified at time of analysis, so exploitation would currently require independent discovery of the specific endpoint and data exposed.