The identified flaw in WPDeveloper’s Templately plugin permits the insertion of sensitive information into outgoing data, enabling an attacker or malicious user to retrieve embedded confidential data. The critical nature of the weakness is reflected by a CVSS score of 10, and the referenced CWE‑201 category highlights the improper handling of protected data.

The vulnerability affects the WordPress Templately plugin from the earliest version through 3.2.7. It is present in all releases of the plugin distributed by WPDeveloper up to that point, but any installation using version 3.2.8 or newer is unaffected.

With an EPSS score of less than 1 % the probability of real‑world exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the high CVSS score indicates that, if an attacker can embed sensitive payloads into a template that is rendered by the plugin, they could obtain data that should remain private. The likely attack vector involves the normal rendering pathway of the plugin where template contents are processed and displayed.