The affected WordPress plugin contains a flaw where error messages expose embedded sensitive data. This weakness allows an attacker, by provoking an error, to retrieve information that should be protected. The vulnerability is identified as CWE-209, indicating that sensitive data is revealed through improper error handling, leading to potential data confidentiality breaches.

WordPress sites using the "Online Booking & Scheduling Calendar for WordPress by vcita" plugin are impacted. Versions from the earliest release through 4.5.5 are vulnerable. No other versions are listed as affected, so upgrades beyond 4.5.5 should eliminate the issue.

The CVSS score of 4.3 suggests moderate severity, but the EPSS score of less than 1% indicates a low probability that the vulnerability is actively exploited in the wild. Since the plugin is web‑accessible, an attacker could trigger the error message through normal usage or crafted requests, causing sensitive data leakage. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The risk primarily depends on whether the plugin’s errors are exposed to end users; disabling detailed errors mitigates the impact.