The vulnerability allows the Envíos Coordinadora Woocommerce plugin to embed and transmit sensitive information in outbound traffic. This occurs because the plugin retrieves and includes confidential data without proper sanitization or communication safeguards. The weakness is classified as CWE‑201, which signifies that data intended to remain confidential is mistakenly exposed or transmitted.

WordPress sites that use Coordinadora Mercantil S.A.’s Envíos Coordinadora Woocommerce plugin versions up to and including 1.1.32 are affected. No specific WordPress core version is cited, but any site with the plugin within the stated range is vulnerable.

With a CVSS score of 5.3 the risk is moderate. The EPSS score of less than 1% suggests exploitation attempts are unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web traffic that the plugin generates, such as API calls or form submissions, where sensitive data can be siphoned. No additional prerequisites beyond having the vulnerable plugin installed are mentioned in the data.