The MoneySpace plugin for WordPress stores complete payment card details—PAN, card holder name, expiry month/year, and CVV—in WordPress post_meta using base64_encode(), then embeds these values into the publicly accessible mspaylink page’s inline JavaScript without any authentication or authorization checks. This flaw, identified as CWE‑200 Sensitive Information Exposure, permits an unauthenticated attacker who knows or can guess an order_id to retrieve full credit card numbers and CVV codes directly from the HTML/JS response, constituting a severe PCI‑DSS violation. The impact is a significant compromise of confidentiality and potential fraudulent exploitation of cardholder data.

All installations of the MoneySpace plugin for WordPress with versions 2.13.9 or earlier are vulnerable. The affected product is identified as MoneySpace, and the vulnerability applies to every build up to and including 2.13.9.

The CVSS score of 8.6 classifies this flaw as high severity, yet the EPSS score is less than 1 %, indicating a low exploitation probability at present. It is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by sending an unauthenticated request to the mspaylink endpoint with a valid or guessable order_id and parsing the inline JavaScript for the base64‑encoded card data. The attack requires no special privileges and can be automated once the target order_id space is enumerated.