A vulnerability in the AA Web Servant 12 Step Meeting List plugin allows the insertion of sensitive information into data that is sent to the client, enabling an attacker to retrieve embedded confidential content. This flaw corresponds to CWE‑201 and permits a confidentiality breach by exposing sensitive data that should not be publicly transmitted.

WordPress sites that use the AA Web Servant 12 Step Meeting List plugin, versions up to and including 3.16.5, are affected. The impact is limited to environments where the plugin is installed and active.

The CVSS score of 5.3 indicates a moderate severity for this defect, and the EPSS score of 6% suggests a moderately low probability of exploitation in the near term. It is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can trigger the plugin’s data retrieval functionality—potentially via a crafted request—can obtain sensitive data. No specific authentication or privilege requirements are mentioned, implying that the risk may be exploitable by unauthenticated users or those with normal access to the plugin’s endpoints. The overall risk is moderate, highlighting the need to address the vulnerability promptly.