A flaw in the WordPress Atarim visual collaboration plugin causes sensitive information that should remain private to be inadvertently included in data sent out of the system, allowing an attacker to retrieve that embedded sensitive data. The vulnerability is catalogued as CWE‑201, which highlights improper handling of confidential information. An attacker who can trigger the vulnerable code path could access personal, credential, or business data exposed through network traffic or plugin responses, compromising confidentiality and potentially privacy of affected users.

The issue affects the Atarim visual collaboration plugin developed by Vito Peleg for all versions up through 4.2.1, including the pre‑4.2.1 releases where the vulnerability is present. Any WordPress installation using any of those affected plugin versions is at risk.

The CVSS score of 7.5 indicates high severity, and the EPSS score of 2% shows a low but non‑zero likelihood of exploitation in the wild. The plugin runs in a web context, so the likely attack vector is remote via HTTP requests to the site. No official listing in the CISA KEV catalog currently. Security researchers have not reported widespread exploitation, but the data exposure risk warrants timely remediation.