WordPress Core <= 7.1 — Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

Overview

Advisory ID

b54af5b0-d79a-4fb2-965f-d3ff4956dc5a

Product

WordPress wordpress

Affected

≤7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

Weakness

CWE-200 Information Exposure

Required access

Unknown

Published

Sep 17, 2026 · updated Nov 13, 2026

Credit

HDWSec

WordPress Core is vulnerable to Information Exposure via the attachment_submitbox_metadata() function in various versions up to, and including, 7.1 due to a missing read_post capability check on an attachment's parent post. This makes it possible for authenticated attackers with upload_files access to view the title of a private or otherwise unreadable parent post to which an attachment is attached.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.