All vulnerabilities

WordPress core

GHSA-p2r6-rwjp-phv3

An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors

Severity: Medium
Published: 29 Oct 2026
Last changed: 29 Oct 2026
Added to UpHeron: 30 Oct 2026
Fixed in: 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

From 7.1.0 before 7.1.4
From 7.0.0 before 7.0.8
From 6.9.0 before 6.9.11
From 6.8.0 before 6.8.12

All 23 release lines

From 4.9.0 before 4.9.35
From 5.0.0 before 5.0.31
From 5.1.0 before 5.1.28
From 5.2.0 before 5.2.30
From 5.3.0 before 5.3.27
From 5.4.0 before 5.4.25
From 5.5.0 before 5.5.24
From 5.6.0 before 5.6.23
From 5.7.0 before 5.7.21
From 5.8.0 before 5.8.19
From 5.9.0 before 5.9.20
From 6.0.0 before 6.0.18
From 6.1.0 before 6.1.16
From 6.2.0 before 6.2.15
From 6.3.0 before 6.3.14
From 6.4.0 before 6.4.14
From 6.5.0 before 6.5.14
From 6.6.0 before 6.6.11
From 6.7.0 before 6.7.11
From 6.8.0 before 6.8.12
From 6.9.0 before 6.9.11
From 7.0.0 before 7.0.8
From 7.1.0 before 7.1.4

References

GitHub Advisory Database https://github.com/advisories/GHSA-p2r6-rwjp-phv3
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-p2r6-rwjp-phv3