Your message dated Fri, 30 Oct 2026 14:47:45 +0000
with message-id <[email protected]>
and subject line Bug#1150336: fixed in wordpress 6.8.12+dfsg1-0+deb13u1
has caused the Debian Bug report #1150336,
regarding wordpress: CVE-2026-66666 and other issues fixed with 7.1.3
maintenance release
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150336: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150336
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: wordpress
Version: 7.1.2+dfsg1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Craig,
The following vulnerability was published for wordpress, filling at RC
level but maybe it can be downgraded. The new 7.1.3 releases fixes
CVE-2026-66666[0]:
| Insertion of Sensitive Information Into Sent Data vulnerability in
| Automattic WordPress allows Retrieve Embedded Sensitive Data. This
| issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through
| 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7
| through 6.7.9, and from 6.6 through 6.6.9.
and a couple of other issues (with no known CVE yet):
> - A stored XSS on the Comments administration page, exploitable
> via pending comments, reported by Trail of Bits in collaboration
> with OpenAI.
> - A DoS issue in the WP_Http::make_absolute_url() method, reported
> by Anthropic
> - A second-Order SQL injection in WordPress WXR export, reported
> by Anthropic
> - A weakness allowing Author role users to sticky posts, reported
> by Anthropic
> - Unauthenticated disclosure of comments on private & unpublished posts,
> reported by Ananda Dhakal from Patchstack
> - Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng
> Yang, and Gavin Zhong
> - Forgeable parameters passed to the {status}_{type} hook can lead to
> action name collision, reported by Alex Concha of the WordPress
> security team
from [1].
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-66666
https://www.cve.org/CVERecord?id=CVE-2026-66666
[1]
https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 6.8.12+dfsg1-0+deb13u1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 29 Oct 2026 20:21:19 +1100
Source: wordpress
Architecture: source
Version: 6.8.12+dfsg1-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Closes: 1150336 1152426
Changes:
wordpress (6.8.12+dfsg1-0+deb13u1) trixie-security; urgency=medium
.
* 6.8.12 backport of security release 7.1.4 Closes: #1152426
Stored XSS with specially crafted block markup.
Privacy Data Removal Requests can be created in a way that leads to
stored XSS.
Multiple stored XSS issues in the Interactivity API.
Stored DoS issue in the Interactivity API.
Stored XSS in Customizer selective refresh.
Stored XSS in the Categories block.
Specially crafted User Logins can lead to a stored XSS.
Unpublished customizer changesets can be discovered by unauthenticated
users.
Stored XSS in Playlist and image blocks.
Stored XSS in core/comments-pagination-next and
core/comments-pagination-previous blocks.
Notes can be read by privileged users that lack access to edit the post
the note is attached to.
* Possibly not applicable but updated anyway:
An update to the bundled root certificates due to the eMudhra revocation.
A weakness in the WordPress upgrade process which can lead to remote code
execution during the upgrade window.
.
* 6.8.11 backport of security release 7.1.3
Unauthenticated disclosure of comments on private & unpublished posts
CVE-2026-66666 Closes: #1150336
Checksums-Sha1:
a7bdb05817912b82b57ce3276c1f4be9ed286bd9 2461
wordpress_6.8.12+dfsg1-0+deb13u1.dsc
a4306da3adcc1050276c99d955adf0d723f68a0b 22347756
wordpress_6.8.12+dfsg1.orig.tar.xz
7a74840b574a0a013cc461f12246cc9980033c28 6914248
wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
5ebdab8569a3891de31fed02cd5230bb4457d3e4 7782
wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
Checksums-Sha256:
81db105c61503bb32ebd364cd333586c17d39f4524a6832416e2fff6fefb09a3 2461
wordpress_6.8.12+dfsg1-0+deb13u1.dsc
97ec3281a9911e3746fc3720fc326ddb04f8ec14ad899f33ba86eb67aa221eae 22347756
wordpress_6.8.12+dfsg1.orig.tar.xz
9e7cf8a0abdfc2d15abef8874b6039e452bf7604d58be93230af9a17af4156d8 6914248
wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
15e88cceaeb463eb7f591a1820d14649172bca2c807e7c8ea8d0597d9f9a8e57 7782
wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
Files:
85ced3df5d2ed7c9d276f8292d78a6ad 2461 web optional
wordpress_6.8.12+dfsg1-0+deb13u1.dsc
f77d4faff269f135be31e4e79c4c145d 22347756 web optional
wordpress_6.8.12+dfsg1.orig.tar.xz
d760ff10da8c661cd6996b8176d882d2 6914248 web optional
wordpress_6.8.12+dfsg1-0+deb13u1.debian.tar.xz
5770e086dcefe551dd104386a8a68ba2 7782 web optional
wordpress_6.8.12+dfsg1-0+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrjHkAACgkQAiFmwP88
hOP3gg/+LH2SGNkSAYmWVHP/yzsLch6F5BtKjGIBDUYQKOJFdfI15UGZYbH/wJ4X
pyzdvcXwTxIfjAFn4fde3npVfxDFoqTs7Jx0j782HMvg2reS//SYP1dGOLfXcnoV
uHGSivRsNtFoY14wTn9XiwZeCouhH88KIDw3TkkAypSpO3ez43XovhT5DhemDM5P
kUXdAF5dGPZZNHZAF7Zker9uxNns4+sHaBVOPFy199g3NljZiougKQ48GfDHKHOg
ls64JN9/Zw1iSKx5kwlj5gLbhd84CwKI8ucqxQMDHWPInqW6r1XvCFPLV8B0pgNs
Pa625G0MXoO0jkMdAJh7BLXu1DMss3ra/o1Ryfus/wdroIP6VT04WNi38qQ5R2WC
MsVCBskEvOwUn2Ntg6MkKuYfzntEHHuG8cxIh05xGaVw9Ohlzs7t/tGXS//yzTvn
wpMfnt3OhYZLVofwwl3NaTg4deqQRHFAE19xF6iupbsjX8Wd98t9l7T8jvqTrESR
8tXZqEeAby/NVfGGwJNXMMQ8R3yAM8SESa3aubkOvqP+KdxLlr28vG0TMo9ZhePv
g3av4z/Xozw6az/OyPZ+TG0Jrx/L15bk9uI1a64I/DIANFAC/V3moP/WfmL2U+dz
Rj56Ss16KcFagu1WcOsw1fmHsFZpm546NmzQmMqAsMDpvgOAam0=
=4jC+
-----END PGP SIGNATURE-----
pgpb6by0MvKKG.pgp
Description: PGP signature
--- End Message ---
