The vulnerability, identified as an Insertion of Sensitive Information Into Sent Data, allows the JetEngine plugin to deliver embedded sensitive data to unauthorized parties. This flaw, classified as CWE‑201, enables attackers to gain access to confidential information that should not be publicly exposed.

The affected product is Crocoblock’s JetEngine plugin for WordPress. Versions from the earliest available through 3.7.0 are impacted. The issue does not affect later releases such as 3.7.1 and above.

The CVSS score of 6.5 categorizes this as a medium‑severity weakness. The EPSS score indicates an exploitation probability of less than 1 %, suggesting that while the flaw is moderate, it is unlikely to be widely exploited. The vulnerability is not listed in the CISA KEV catalog. Because the description does not specify an exact attack vector, the likely vector is a remote web‑based request that triggers the plugin to send sensitive data to the requester. No privilege escalation or code execution is required; the risk is confined to unauthorized disclosure of protected information.