The vulnerability is an insertion of sensitive information into data sent from the MultiVendorX plugin, allowing attackers to retrieve embedded sensitive data. This flaw results in a loss of confidentiality for any data handled by the plugin. It is categorized as CWE-201, indicating an error in protecting sensitive data during transmission or storage.

Sites running WordPress that have the MultiVendorX plugin installed are vulnerable when the plugin version is 4.2.22 or earlier. The issue spans all releases of MultiVendorX from its initial release up to 4.2.22, regardless of the WordPress version or hosting environment.

The CVSS score of 7.5 indicates a moderate to high risk for confidentiality. The EPSS score of <1% suggests that the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV. The plugin exposes sensitive data through its data retrieval mechanisms, so the attack vector is likely a remote request to the plugin’s API or administrative interface, potentially requiring authentication. Successful exploitation requires network access to the WordPress site and insufficient access controls on the plugin’s endpoints.