The Easy Post Submission plugin allows the insertion of sensitive information into data that is sent back to users, enabling an attacker to retrieve embedded sensitive data and thereby compromise confidentiality. This flaw exemplifies CWE‑201, where disallowed exposure of sensitive information occurs through improper data handling.

WordPress sites that have the ThemeRuby Easy Post Submission plugin at version 1.7.0 or earlier are affected. Administrators should audit any installations from the earliest release up to and including 1.7.0 for potential exposure.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, reducing the perceived attack risk. The likely attack vector is remote via the plugin’s web interface, where an unauthenticated or authenticated user could trigger a request that returns sensitive data. No privilege escalation or code execution is required; the risk is confined to confidentiality compromise.