The Hive Support WordPress plugin contains an insertion of sensitive information into sent data, allowing an attacker to retrieve embedded sensitive data embedded by the plugin. This flaw results in a confidentiality compromise, classified as CWE‑201, enabling an unauthorized actor to access data that should remain private or restricted.

WordPress sites that have the Hive Support plugin from Hive Support installed with a version equal to or older than 1.2.6 are impacted. Any instance of the plugin in these versions may expose sensitive information to external parties.

The vulnerability carries a CVSS score of 7.5, indicating a high level of severity. The EPSS score is reported as less than 1 %, implying the probability of exploitation is currently low but not zero, and the issue is not listed in CISA’s KEV catalog. The most likely attack vector is remote, through a web request to the plugin’s data handling endpoint, allowing an attacker to trigger the exposure of sensitive data without any further privileges. Prompt remediation is recommended given the confidentiality impact and the potential for exploitation if a lack of safeguards is present.