The vulnerability is an insertion of sensitive information into outbound email data via the WP Mailster plugin. An attacker can retrieve confidential data that was unintentionally embedded in the email payload created by the plugin, potentially exposing private user information or system credentials. This flaw arises from improper handling of sensitive content in the email generation process and results in unauthorized disclosure of protected data.

The flaw affects the WP Mailster plugin developed by brandtoss for WordPress. Versions up to and including 1.8.17.0 are impacted. WordPress sites that install or rely on those plugin versions are vulnerable to sensitive data leakage through the plugin’s email functionality.

The CVSS base score is 5.3, indicating moderate severity, while the EPSS score is below 1%, suggesting a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would typically require the attacker to trigger the plugin’s email sending logic, which could be achieved through normal site operations or by submitting input that causes emails to be sent. Although no public exploit is known, the low EPSS score and lack of a KEV listing reduce the immediate risk, making regular monitoring and patching the most effective mitigations.