The WordPress Varnish/Nginx Proxy Caching plugin up to version 1.8.3 contains an insertion of sensitive information into sent data flaw. An attacker can retrieve embedded sensitive data through this vulnerability, exposing information that should remain confidential. The weakness is identified as CWE‑201, a data exposure issue.

Affected systems are installations of the Razvan Stanga Varnish/Nginx Proxy Caching plugin for WordPress, specifically any version from the earliest available through 1.8.3 inclusive.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of 3% suggests a low but non‑negligible probability of exploitation. The issue is not listed in CISA KEV, implying no widespread known exploitation. Likely exploitation requires that the plugin be activated and that the application or user context enables the plugin’s caching mechanism. The vendor’s documentation does not specify preconditions, so the likely attack vector is through the plugin’s normal operation on a WordPress site.