The WP AI CoPilot plugin for WordPress contains an insertion of sensitive information into data that is sent out, allowing an attacker to retrieve embedded sensitive data. This flaw is categorized as CWE‑201: Information Exposure Through an Insecure Function. The exposed data can include credentials or other confidential information that the plugin inadvertently transmits, leading to potential loss of confidentiality for site administrators and visitors.

WP Messiah’s WP AI CoPilot plugin, any release from the earliest available version up to and including 1.2.7, is vulnerable. This includes all installations of the plugin that have not been updated beyond version 1.2.7.

The CVSS score of 4.3 indicates a low‑to‑moderate severity. The EPSS score is below 1 %, suggesting that known exploitation is unlikely at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Because the description does not specify an attack vector, it is inferred that exploitation may require either authenticated access or could be remote if the plugin’s endpoints are exposed externally. The risk to sensitive data exposure is therefore present, but the likelihood of exploitation is low.