WordPress Vulnerabilities

WP < 7.0.3 - Unauthenticated Internal Note Disclosure via Comment Feeds

Description

WordPress does not exclude internal notes from the public comment feeds, allowing unauthenticated users to read their content.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Elio Gubser (odkdn1)
Verified
Yes
WPVDB ID
44de300f-c00a-4702-b215-2286b48495f7

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2022-03-30
Title
Be POPIA Compliant < 1.1.6 - Unauthenticated Sensitive Information Exposure
Published
2025-12-29
Title
PopupKit < 2.2.1 - Authenticated (Subscriber+) Information Exposure
Published
2024-08-14
Title
Newsletters < 4.9.9.1 - Unauthenticated Full Path Disclosure
Published
2026-09-11
Title
Royal Elementor Addons < 1.7.1067 - Unauthenticated Post Meta Disclosure via 'wpr_keyword' Parameter
Published
2023-02-27
Title
Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure