The Atarim Visual Collaboration plugin contains an insertion of sensitive information into data that is sent to users, allowing attacker-controlled data to be embedded and retrieved. This flaw enables an adversary to obtain confidential information that should not be disclosed, making confidentiality of user data at risk. The issue is identified as CWE‑201, representing sensitive data exposure.

The vulnerability impacts the Vito Peleg Atarim plugin for WordPress versions up to and including 4.2.1. No other vendors or products are listed as affected.

With a CVSS score of 5.3 the flaw is of moderate severity. The EPSS score of less than 1% indicates that the predicted probability of exploitation is small, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is not explicitly stated in the advisory; it is inferred that the flaw could be exploited remotely by any user who can trigger the plugin’s data transmission. Given the moderate severity and low exploitation probability, the overall risk remains moderate but warrants patching to eliminate the possibility of sensitive data leakage.