The vulnerability, described as an insertion of sensitive information into data sent from WordPress, allows an attacker to retrieve embedded sensitive data from comments on private or unpublished posts. This is a typical information‑exposure weakness (CWE‑201) compromising confidentiality. The flaw can be exercised without authentication by requesting the comment feed URL. Because the feed is publicly reachable, anyone who can generate a request can see the data that belongs on a private or unpublished post, exposing potentially confidential user or site information.

WordPress Core by Automattic from any version up to and including 7.1.2 is vulnerable. The fix is provided in WordPress Core 7.1.3 and later. All deployments of WordPress Core versions 7.1.2 or older are affected and should be updated.

The vulnerability has a CVSS score of 6.9, which classifies it as moderate. EPSS data is not available, so the exploitation likelihood cannot be quantified, but the flaw exposes data through a publicly reachable endpoint, enabling straightforward unauthenticated data theft. The attack requires no special credentials or elevated privileges; simply accessing the comment feed URL on a vulnerable site is sufficient to extract the protected content.