The vulnerability is an Insertion of Sensitive Information Into Sent Data flaw in the Ideal Postcodes UK Address Postcode Validation plugin. It allows an attacker to retrieve embedded sensitive data from HTTP responses or other outbound data generated by the plugin. This results in a privacy breach where personal information such as addresses and postcodes may be exfiltrated. The weakness is classified as CWE-201, a sensitive data exposure vulnerability.

This issue affects all installations of the Ideal Postcodes UK Address Postcode Validation WordPress plugin through version 3.9.2. The plugin is used by WordPress sites that enable postcode validation, and any site running these affected versions is vulnerable.

The CVSS score is 5.3, indicating medium severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote request to the website that triggers the plugin’s postcode validation logic, resulting in sensitive data being sent in the response; this inference is based on the plugin’s function as described.