The vulnerability allows an attacker to insert sensitive information into data transmitted by the Publitio plugin, enabling the attacker to retrieve hidden secrets such as API keys or credentials. This results in leakage of confidential data that could facilitate further compromise. The weakness is identified as CWE‑201, insertion of sensitive information into sent data. The impact is a loss of confidentiality for any data managed by the plugin, without directly affecting availability or integrity.

Any WordPress site using the Publitio plugin version 2.2.5 or older is affected. This includes all installations of the plugin whose active version is not a more recent release. Site owners should verify the plugin version and confirm whether updates or changes to the component have been applied.

The CVSS score is 5.0, indicating medium severity. The EPSS score is less than 1%, reflecting a very low current exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is via normal web requests to the plugin’s endpoints, as the flaw is inherent to the plugin’s routine operation. An attacker would need network access to the affected WordPress installation but no special privileges are required. Overall, the risk is moderate with limited evidence of active exploitation.