The Barcode Generator for WooCommerce plugin contains an Insertion of Sensitive Information Into Sent Data flaw that enables an attacker to retrieve embedded sensitive data from product pages and orders. This flaw can leak non‑public information such as account credentials, payment details or personal user data that were encoded within the barcodes, leading to a moderate confidentiality risk for any organization that relies on the integrity of the data displayed by the plugin.

All versions of the Barcode Generator for WooCommerce by Dmitry V. (CEO of UKR Solution) up to and including 2.0.2 are affected. The issue appears on WordPress sites that install this plugin to embed barcodes on product pages and order confirmations; no platform restrictions are noted.

The CVSS score of 6.5 combined with an EPSS score of less than 1% indicates moderate severity and a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation would likely occur through the public web interface of a WordPress site running the vulnerable plugin, with the attacker manipulating requests that cause the plugin to send encoded data back to them. Because the flaw does not require local user credentials, broader impact is possible if the site is exposed.