Your message dated Fri, 16 Oct 2026 11:08:32 +0000
with message-id <[email protected]>
and subject line Bug#1150336: fixed in wordpress 7.1.3+dfsg1-1
has caused the Debian Bug report #1150336,
regarding wordpress: CVE-2026-66666 and other issues fixed with 7.1.3
maintenance release
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150336: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150336
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: wordpress
Version: 7.1.2+dfsg1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Craig,
The following vulnerability was published for wordpress, filling at RC
level but maybe it can be downgraded. The new 7.1.3 releases fixes
CVE-2026-66666[0]:
| Insertion of Sensitive Information Into Sent Data vulnerability in
| Automattic WordPress allows Retrieve Embedded Sensitive Data. This
| issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through
| 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7
| through 6.7.9, and from 6.6 through 6.6.9.
and a couple of other issues (with no known CVE yet):
> - A stored XSS on the Comments administration page, exploitable
> via pending comments, reported by Trail of Bits in collaboration
> with OpenAI.
> - A DoS issue in the WP_Http::make_absolute_url() method, reported
> by Anthropic
> - A second-Order SQL injection in WordPress WXR export, reported
> by Anthropic
> - A weakness allowing Author role users to sticky posts, reported
> by Anthropic
> - Unauthenticated disclosure of comments on private & unpublished posts,
> reported by Ananda Dhakal from Patchstack
> - Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng
> Yang, and Gavin Zhong
> - Forgeable parameters passed to the {status}_{type} hook can lead to
> action name collision, reported by Alex Concha of the WordPress
> security team
from [1].
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-66666
https://www.cve.org/CVERecord?id=CVE-2026-66666
[1]
https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 7.1.3+dfsg1-1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 21:48:07 +1100
Source: wordpress
Architecture: source
Version: 7.1.3+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Closes: 1150336
Changes:
wordpress (7.1.3+dfsg1-1) unstable; urgency=high
.
* New upstream security release
Unauthenticated disclosure of comments on private & unpublished posts
CVE-2026-66666 Closes: #1150336
Checksums-Sha1:
312be50a379cbdfa5fa79a26af8f8744efc784c5 2359 wordpress_7.1.3+dfsg1-1.dsc
97aab5adc3c6eac07dc26386665f44f52abf5810 28034636
wordpress_7.1.3+dfsg1.orig.tar.xz
1d59d22c008a3431af20ea4274e24eae957b4168 1603688
wordpress_7.1.3+dfsg1-1.debian.tar.xz
fd997f79ad032c491075037a3c169138289bfc14 7219
wordpress_7.1.3+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
dae0667e6f856f08d15e23431f37303234e83e8bfa29fbf07b83627316f09669 2359
wordpress_7.1.3+dfsg1-1.dsc
437e71b627c778b6f011b80ca6cd750464dcc64ba4c1744ac7e4a7112dd39d67 28034636
wordpress_7.1.3+dfsg1.orig.tar.xz
7c9082f7760573ddb7d870e49b8036e348b961f093b38017021869e0c7217d9f 1603688
wordpress_7.1.3+dfsg1-1.debian.tar.xz
1ff95ba448de2e0dff0741938d705360d30a33260573ac9b6f62e94145a20241 7219
wordpress_7.1.3+dfsg1-1_amd64.buildinfo
Files:
6b107ae3ec0f776e1a9bf33d2e5eb059 2359 web optional wordpress_7.1.3+dfsg1-1.dsc
ad73ebf0c6102eea338c13a9370c6775 28034636 web optional
wordpress_7.1.3+dfsg1.orig.tar.xz
501cc18b7e3c8f86ba3d00f2ea1ada9b 1603688 web optional
wordpress_7.1.3+dfsg1-1.debian.tar.xz
bfc0140451ea45e1d4ca3f2c52b1efbc 7219 web optional
wordpress_7.1.3+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmrSAi0ACgkQAiFmwP88
hOPOKw/9FfeKzPQ3IfhrFrjFm+Yif0JZYC96NhOATc/gEh02eyYauHGXRbygqx/K
GvYo5cjg7EfCouchyAlH7kZ1rtaghEPHC8PnCDjAAjmYrxdwreKaaW8zZSSZKhaP
mr17X5bLr7vpeCNYc4/tlhFsK6t5rTq6ryY7WfRa1RQ6rYiJ2MDeS5ZwYMI22GaA
rXVv5ApZDPAReo27gvAIBs6GkyhreppSf8Zm5o0gl4S4h8chPFDZATb3V+r5qnCy
t4kalc8khUcrycSeGcpu19e6CTt4WSi+wWnIdn6szj5D8Gw8JUeinGeKWwXtzEcl
RqoOL6PXQnEjEFWDYWdg0kGsI2sfNevGCY8WP9rnqqodfKRiEAKssK/Ssdj/A4fp
5m+4QtwIk3o1CCXPY0figwEAbkQMouY3VJ8UHyBI9GvN01xAype5oo0UYl+9D7Q+
zcNt3PtMMsXi/OG3eKYuY79I25zpaL/44UB9cyjEH/6RteBUxkhCgOH5064x0X6O
LfBjqncQce5KBIzJeKOy/mTsZR+AAqRwh2ZkTiw17AZeKlYD2jw8iRTwgLv8ALBD
Wd8LFqt1grkm+HW+OO2nx33ZiNuXPodFha4hgxlX0Am8g0fJUop9A1QlJxOBUfHi
b/zusb53Dv8qXVGLdPpCt1jD4NBZLmgU2a4q3a/7K96GH71xYdQ=
=lWI8
-----END PGP SIGNATURE-----
pgpAaz7mxavWe.pgp
Description: PGP signature
--- End Message ---
