The AppExperts plugin for WordPress contains an insertion flaw that allows sensitive information to be embedded into data sent to external services. An attacker who triggers this data flow can retrieve sensitive data that the plugin inadvertently exposes. The weakness is identified as CWE-201, Sensitive Information Exposure. This flaw permits data leakage that can undermine confidentiality and allow attackers to gain insight into the internal workings of the site.

The vulnerability affects the AppExperts WordPress plugin developed by Saad Iqbal. All installations using AppExperts version 1.4.3 or earlier are vulnerable, including every version from the earliest available release up through 1.4.3.

The CVSS score of 5.3 indicates medium severity. The EPSS score is below 1%, which suggests a very low probability of exploitation in the wild, and the weakness is not currently listed in CISA's KEV catalog. The likely attack vector is through the plugin's data-submission interface; an attacker who triggers the flaw could obtain the leaked data. Because no public exploits have been reported, the risk remains theoretical but should be addressed prior to exposure.