Vulnerability · Published Sep 23, 2025 · Assigned by Patchstack
CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability
Medium 4.3
In plain English
A medium-severity security flaw in WordPress from WordPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from 5.8 through 5.8.11, from 5.7 through 5.7.13, from 5.6 through 5.6.15, from 5.5 through 5.5.16, from 5.4 through 5.4.17, from 5.3 through 5.3.19, from 5.2 through 5.2.22, from 5.1 through 5.1.20, from 5.0 through 5.0.23, from 4.9 through 4.9.27, from 4.8 through 4.8.26, from 4.7 through 4.7.30.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | wordpress | 6.1.9+dfsg1-0+deb12u1 | DEBIAN-CVE-2025-58246 |
| Debian:12 | wordpress | 6.1.9+dfsg1-0+deb12u1 | DSA-6075-1 |
| Debian:13 | wordpress | 6.8.3+dfsg1-0+deb13u1 | DEBIAN-CVE-2025-58246 |
| Debian:13 | wordpress | 6.8.3+dfsg1-0+deb13u1 | DSA-6091-1 |
| Debian:14 | wordpress | 6.8.3+dfsg1-1 | DEBIAN-CVE-2025-58246 |
| Ubuntu:22.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2025-58246 |
| Ubuntu:24.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2025-58246 |
| Ubuntu:25.10 | wordpress | no fix listed | UBUNTU-CVE-2025-58246 |
| Ubuntu:26.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2025-58246 |
| Ubuntu:26.10 | wordpress | no fix listed | UBUNTU-CVE-2025-58246 |
Affected products (as reported)
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N