Hi Craig,

The following vulnerability was published for wordpress, filling at RC
level but maybe it can be downgraded. The new 7.1.3 releases fixes

CVE-2026-66666[0]:
| Insertion of Sensitive Information Into Sent Data vulnerability in
| Automattic WordPress allows Retrieve Embedded Sensitive Data.  This
| issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through
| 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7
| through 6.7.9, and from 6.6 through 6.6.9.

and a couple of other issues (with no known CVE yet):

from [1].



If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66666
https://www.cve.org/CVERecord?id=CVE-2026-66666
[1] https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150336@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Craig Small <csmall@debian.org> (supplier of updated wordpress package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 16 Oct 2026 21:48:07 +1100
Source: wordpress
Architecture: source
Version: 7.1.3+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <csmall@debian.org>
Changed-By: Craig Small <csmall@debian.org>
Closes: 1150336
Changes:
 wordpress (7.1.3+dfsg1-1) unstable; urgency=high
 .
   * New upstream security release
     Unauthenticated disclosure of comments on private & unpublished posts
     CVE-2026-66666 Closes: #1150336
Checksums-Sha1:
 312be50a379cbdfa5fa79a26af8f8744efc784c5 2359 wordpress_7.1.3+dfsg1-1.dsc
 97aab5adc3c6eac07dc26386665f44f52abf5810 28034636 wordpress_7.1.3+dfsg1.orig.tar.xz
 1d59d22c008a3431af20ea4274e24eae957b4168 1603688 wordpress_7.1.3+dfsg1-1.debian.tar.xz
 fd997f79ad032c491075037a3c169138289bfc14 7219 wordpress_7.1.3+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
 dae0667e6f856f08d15e23431f37303234e83e8bfa29fbf07b83627316f09669 2359 wordpress_7.1.3+dfsg1-1.dsc
 437e71b627c778b6f011b80ca6cd750464dcc64ba4c1744ac7e4a7112dd39d67 28034636 wordpress_7.1.3+dfsg1.orig.tar.xz
 7c9082f7760573ddb7d870e49b8036e348b961f093b38017021869e0c7217d9f 1603688 wordpress_7.1.3+dfsg1-1.debian.tar.xz
 1ff95ba448de2e0dff0741938d705360d30a33260573ac9b6f62e94145a20241 7219 wordpress_7.1.3+dfsg1-1_amd64.buildinfo
Files:
 6b107ae3ec0f776e1a9bf33d2e5eb059 2359 web optional wordpress_7.1.3+dfsg1-1.dsc
 ad73ebf0c6102eea338c13a9370c6775 28034636 web optional wordpress_7.1.3+dfsg1.orig.tar.xz
 501cc18b7e3c8f86ba3d00f2ea1ada9b 1603688 web optional wordpress_7.1.3+dfsg1-1.debian.tar.xz
 bfc0140451ea45e1d4ca3f2c52b1efbc 7219 web optional wordpress_7.1.3+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrSAi0ACgkQAiFmwP88
hOPOKw/9FfeKzPQ3IfhrFrjFm+Yif0JZYC96NhOATc/gEh02eyYauHGXRbygqx/K
GvYo5cjg7EfCouchyAlH7kZ1rtaghEPHC8PnCDjAAjmYrxdwreKaaW8zZSSZKhaP
mr17X5bLr7vpeCNYc4/tlhFsK6t5rTq6ryY7WfRa1RQ6rYiJ2MDeS5ZwYMI22GaA
rXVv5ApZDPAReo27gvAIBs6GkyhreppSf8Zm5o0gl4S4h8chPFDZATb3V+r5qnCy
t4kalc8khUcrycSeGcpu19e6CTt4WSi+wWnIdn6szj5D8Gw8JUeinGeKWwXtzEcl
RqoOL6PXQnEjEFWDYWdg0kGsI2sfNevGCY8WP9rnqqodfKRiEAKssK/Ssdj/A4fp
5m+4QtwIk3o1CCXPY0figwEAbkQMouY3VJ8UHyBI9GvN01xAype5oo0UYl+9D7Q+
zcNt3PtMMsXi/OG3eKYuY79I25zpaL/44UB9cyjEH/6RteBUxkhCgOH5064x0X6O
LfBjqncQce5KBIzJeKOy/mTsZR+AAqRwh2ZkTiw17AZeKlYD2jw8iRTwgLv8ALBD
Wd8LFqt1grkm+HW+OO2nx33ZiNuXPodFha4hgxlX0Am8g0fJUop9A1QlJxOBUfHi
b/zusb53Dv8qXVGLdPpCt1jD4NBZLmgU2a4q3a/7K96GH71xYdQ=
=lWI8
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150336@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Craig Small <csmall@debian.org> (supplier of updated wordpress package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 29 Oct 2026 20:21:19 +1100
Source: wordpress
Architecture: source
Version: 6.8.12+dfsg1-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Craig Small <csmall@debian.org>
Changed-By: Craig Small <csmall@debian.org>
Closes: 1150336 1152426
Changes:
 wordpress (6.8.12+dfsg1-0+deb13u1) trixie-security; urgency=medium
 .
   * 6.8.12 backport of security release 7.1.4 Closes: #1152426
      Stored XSS with specially crafted block markup.
      Privacy Data Removal Requests can be created in a way that leads to
       stored XSS.
      Multiple stored XSS issues in the Interactivity API.
      Stored DoS issue in the Interactivity API.
      Stored XSS in Customizer selective refresh.
      Stored XSS in the Categories block.
      Specially crafted User Logins can lead to a stored XSS.
      Unpublished customizer changesets can be discovered by unauthenticated
       users.
      Stored XSS in Playlist and image blocks.
      Stored XSS in core/comments-pagination-next and
       core/comments-pagination-previous blocks.
      Notes can be read by privileged users that lack access to edit the post
       the note is attached to.
    * Possibly not applicable but updated anyway:
      An update to the bundled root certificates due to the eMudhra revocation.
      A weakness in the WordPress upgrade process which can lead to remote code
       execution during the upgrade window.
 .
   * 6.8.11 backport of security release 7.1.3
     Unauthenticated disclosure of comments on private & unpublished posts
     CVE-2026-66666 Closes: #1150336
Checksums-Sha1:
 a7bdb05817912b82b57ce3276c1f4be9ed286bd9 2461 wordpress_6.8.12+dfsg1-0+deb13u1.dsc
 a4306da3adcc1050276c99d955adf0d723f68a0b 22347756 wordpress_6.8.12+dfsg1.orig.tar.xz
 7a74840b574a0a013cc461f12246cc9980033c28 6914248 wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
 5ebdab8569a3891de31fed02cd5230bb4457d3e4 7782 wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
Checksums-Sha256:
 81db105c61503bb32ebd364cd333586c17d39f4524a6832416e2fff6fefb09a3 2461 wordpress_6.8.12+dfsg1-0+deb13u1.dsc
 97ec3281a9911e3746fc3720fc326ddb04f8ec14ad899f33ba86eb67aa221eae 22347756 wordpress_6.8.12+dfsg1.orig.tar.xz
 9e7cf8a0abdfc2d15abef8874b6039e452bf7604d58be93230af9a17af4156d8 6914248 wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
 15e88cceaeb463eb7f591a1820d14649172bca2c807e7c8ea8d0597d9f9a8e57 7782 wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
Files:
 85ced3df5d2ed7c9d276f8292d78a6ad 2461 web optional wordpress_6.8.12+dfsg1-0+deb13u1.dsc
 f77d4faff269f135be31e4e79c4c145d 22347756 web optional wordpress_6.8.12+dfsg1.orig.tar.xz
 d760ff10da8c661cd6996b8176d882d2 6914248 web optional wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
 5770e086dcefe551dd104386a8a68ba2 7782 web optional wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrjHkAACgkQAiFmwP88
hOP3gg/+LH2SGNkSAYmWVHP/yzsLch6F5BtKjGIBDUYQKOJFdfI15UGZYbH/wJ4X
pyzdvcXwTxIfjAFn4fde3npVfxDFoqTs7Jx0j782HMvg2reS//SYP1dGOLfXcnoV
uHGSivRsNtFoY14wTn9XiwZeCouhH88KIDw3TkkAypSpO3ez43XovhT5DhemDM5P
kUXdAF5dGPZZNHZAF7Zker9uxNns4+sHaBVOPFy199g3NljZiougKQ48GfDHKHOg
ls64JN9/Zw1iSKx5kwlj5gLbhd84CwKI8ucqxQMDHWPInqW6r1XvCFPLV8B0pgNs
Pa625G0MXoO0jkMdAJh7BLXu1DMss3ra/o1Ryfus/wdroIP6VT04WNi38qQ5R2WC
MsVCBskEvOwUn2Ntg6MkKuYfzntEHHuG8cxIh05xGaVw9Ohlzs7t/tGXS//yzTvn
wpMfnt3OhYZLVofwwl3NaTg4deqQRHFAE19xF6iupbsjX8Wd98t9l7T8jvqTrESR
8tXZqEeAby/NVfGGwJNXMMQ8R3yAM8SESa3aubkOvqP+KdxLlr28vG0TMo9ZhePv
g3av4z/Xozw6az/OyPZ+TG0Jrx/L15bk9uI1a64I/DIANFAC/V3moP/WfmL2U+dz
Rj56Ss16KcFagu1WcOsw1fmHsFZpm546NmzQmMqAsMDpvgOAam0=
=4jC+
-----END PGP SIGNATURE-----