WordPress Core contains a vulnerability (CWE-201) that allows an authenticated user with contributor privileges to embed sensitive information into sent data, enabling an attacker to retrieve that sensitive data. The issue is identified as low severity and requires the user to be authenticated as a contributor to exploit. The vulnerability could expose private information or credentials stored within the site, potentially compromising confidentiality of content or administrative data.

WordPress core versions from 4.7 through 4.7.30, and all releases in the 4.8.x series through 6.8.2, are affected. The vulnerability spans all releases in those series, including the specific minor releases listed in the vendor statement.

The CVSS score of 4.3 indicates a low overall risk, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level, so the attack vector is primarily internal and relies on the attacker already having contributor privileges. Attackers can manipulate specific requests or responses to extract embedded sensitive data, as the core does not properly sanitize data before transmission.