The Traveler Option Tree plugin for WordPress contains a vulnerability that permits the retrieval of embedded sensitive data that has been inserted into sent responses by the plugin. This flaw exposes sensitive configuration information to an intruder. The issue impacts Traveler Option Tree versions from n/a through 2.8 and is identified as CWE‑201 Sensitive Information Exposure.

Vendors: shinetheme. Product: Traveler Option Tree – a WordPress custom‑option‑tree plugin. Version range: all released versions up to and including 2.8 are vulnerable. The plugin is installed on WordPress sites using the shinetheme Traveler Option Tree component.

The publicly available CVSS score is 2.7, indicating a low‑severity risk, while the EPSS score is below 1 %, implying a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the WordPress administrative interface or plugin API. Since the flaw exposes data that has already been injected into response payloads, an attacker could retrieve the embedded sensitive data, and the impact remains limited to confidentiality. No special privileges or network access are required beyond basic access to the vulnerable site.