What happened
An information disclosure vulnerability has been identified in various versions of Automattic WordPress. The issue permits the insertion of sensitive data into sent content, which can then be retrieved by unauthorised parties. This vulnerability is specifically associated with the capability for embedded data to leak sensitive information, impacting affected installations that have not yet been updated. The flaw was reported by the National Vulnerability Database (NVD), and an official fix has not yet been made available, indicating that systems remain at risk if not mitigated through other controls.
Who is affected
Affected deployments are those running WordPress versions from 6.8 to 6.8.10, 6.9 to 6.9.9, 7.0 to 7.0.6, and 7.1 to 7.1.2. These versions are susceptible to the vulnerability due to the flaw in how content is inserted and sent, which may result in leakage of sensitive information embedded within content. The severity has been classified as medium, reflecting a moderate but notable risk of data exposure. There is no evidence to suggest widespread exploitation or active campaigns at this time, but affected organisations are advised to limit potential exposure.
Recommended actions
- Review content handling practices to restrict the insertion and transmission of sensitive data where possible, particularly in content that may be embedded or sent outside of trusted environments.
- Implement network controls to limit access to embedding functionalities and transmission pathways where feasible, reducing the potential for malicious data retrieval.
- Monitor for any unusual activity related to embedded content or data exfiltration vectors. Pay particular attention to uploads or content modifications that could be associated with the flaw.
- Stay informed regarding updates from the WordPress vendor or security advisories for patches or mitigations once they become available.
Indicators of compromise
No specific indicators of compromise have been supplied at this time.
