The vulnerability arises from Insertion of Sensitive Information Into Sent Data within the The Tribal WordPress plugin. When the plugin processes requests, it inadvertently includes embedded sensitive data in responses, enabling an attacker to retrieve confidential information. This disclosure can compromise user data, settings, or authentication tokens, thus breaching confidentiality without affecting integrity or availability.

The Tribal plugin for WordPress, versions below or equal to 1.3.3, is affected. All WordPress sites that have installed this plugin at any release from the early build through 1.3.3 are vulnerable, regardless of the current WordPress core version.

The CVSS score of 5.3 categorizes the impact as moderate. The EPSS score of less than 1% indicates a very low likelihood of exploitation detected by the threat intelligence community. The vulnerability is not catalogued in CISA's Known Exploited Vulnerabilities list. Likely attack vectors involve a local or authenticated attacker triggering plugin functionality to expose data; however, the lack of public exploitation examples suggests that the risk to untreated systems remains low to moderate.