Sensitive Data Exposure in Automattic WordPress
CVE-2025-58246

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WordPress
Vendor
CVE Published:
23 September 2025

What is CVE-2025-58246?

A sensitive data exposure vulnerability exists within Automattic WordPress that enables the retrieval of sensitive embedded data sent during interactions. This issue primarily affects WordPress versions up to and including 6.8.2 and necessitates contributor-level privileges for exploitation. The WordPress Core security team is actively addressing this vulnerability to enhance website security and protect user information.

Affected Version(s)

WordPress <= 6.8.2

References

https://patchstack.com/database/wordpress/wordpress/wordp...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abu Hurayra (Patchstack Bug Bounty Program)
JSON
.
CVE-2025-58246 : Sensitive Data Exposure in Automattic WordPress