The FoodBook plugin contains a vulnerability that allows an attacker to retrieve embedded sensitive data. The flaw arises from insecure handling of data that is inserted into outgoing responses, leading to exposure of information that should be protected. This results in a confidentiality breach and a moderate security impact, reflected in the CVSS score of 5.3.

Affected systems include the WordPress FoodBook plugin from any version up to and including 4.7.6. All installations of the plugin within this range are potentially vulnerable.

The CVSS score indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: a threat actor can trigger the vulnerable code by accessing a WordPress site that uses the affected plugin, causing the plugin to send sensitive information back in the HTTP response. No additional prerequisites are specified, so a simple web request could potentially disclose data to anyone who can view the response.