WordPress Vulnerabilities

WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block

Description

Gutenberg does not check whether a post is password protected before displaying the full text of its comments, which could allow unauthenticated users to read comments left on password protected posts. The affected block ships both in the Gutenberg plugin and, bundled, in WordPress core.

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3

Affects Plugins

Plugin icon
gutenberg
Fixed in 23.7.1

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ehtisham Siddiqui
Verified
Yes
WPVDB ID
6850768f-c956-4c2f-8f82-8a3ef9dd2062

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-07 (about 1 month ago)
Last Updated
2026-08-07 (about 1 month ago)

Other

Published
Title
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Published
2026-08-25
Title
TranslatePress < 3.3.2 - Unauthenticated Account Takeover via Password Reset Link Disclosure
Published
2024-12-07
Title
WP Mailster < 1.8.17.0 - Unauthenticated Sensitive Information Exposure
Published
2026-05-21
Title
Slider by Soliloquy < 2.8.2 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
Published
2024-04-05
Title
ConvertKit < 2.4.6 - Unauthenticated Sensitive Information Exposure