The vulnerability resides in the ProveSource Social Proof plugin version 3.1.2 and earlier, allowing an attacker who can access the plugin’s interface to retrieve embedded sensitive data. This exposure can lead to the leakage of configuration details or other privileged information that the plugin stores or processes, thereby compromising confidentiality. The weakness is identified as CWE‑497, which signifies that sensitive data is disclosed after a decryption or validation step.

ProveSource LTD’s ProveSource Social Proof plugin is affected. All installations running version 3.1.2 or older are vulnerable.

The CVSS score of 5.3 indicates a moderate severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is a local or remote request to the plugin’s data‑retrieval endpoint, accessible to users with sufficient privileges or to unauthenticated users if the set‑up is misconfigured. An attacker could exploit this by sending a crafted request to the plugin to obtain the hidden sensitive data.