The GTM Kit plugin for WordPress contains a flaw in which debug messages reveal unnecessary information, enabling an attacker to retrieve embedded sensitive data. This privacy information disclosure undermines confidentiality, potentially allowing access to configuration details or personal information without requiring system compromise. The weakness is classified as CWE‑1295, a privacy data disclosure vulnerability.

WordPress sites that include the GTM Kit plugin from any version up to and including 2.4.0 are affected. The vendor is TLA Media, and the product is the GTM Kit WordPress plugin. No sub‑version list beyond the upper bound of 2.4.0 is available.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an actor who can trigger or view the debug output; this may necessitate authenticated administrative access or the plugin displaying logs in the web interface. Once activated, an attacker could harvest sensitive configuration or personal data without altering the system in a destructive manner.