WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

2026-09-17 00:00
HDWSec

Strategic Overview

Status
Patched in 6.6.8
Affected Core
WordPress 7.1
Affected Version
6.6.7 – 7.1 · 6 branches
CVSS
4.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE pending
View all WordPress 7.1 vulnerabilities

At a glance

This record tracks a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the WordPress 7.1 WordPress release line, affecting 6.6.7 – 7.1 · 6 branches. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Author level or above. The issue is fixed in version 6.6.8; sites on affected versions should update now. Disclosed September 2026, reported by HDWSec.

Vulnerability Overview

WordPress Core is vulnerable to Information Exposure via the attachment_submitbox_metadata() function in various versions up to, and including, 7.1 due to a missing read_post capability check on an attachment's parent post. This makes it possible for authenticated attackers with upload_files access to view the title of a private or otherwise unreadable parent post to which an attachment is attached.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

WordPress 7.1 6.6.7 – 7.1 · 6 branches carries this weakness at attachment_submitbox_metadata(), and reaching it takes an account at Author level or above. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For WordPress 7.1 the fix is 6.6.8: builds 6.6.7 – 7.1 · 6 branches are affected, anything from 6.6.8 onward is not.

Remediation

Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

How does WordSec protect against this?

The fix is the thing that ends this: updating to 6.6.8 is the step that ends it.

  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b54af5b0-d79a-4fb2-965f-d3ff4956dc5a

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C