The plugin contains a flaw that permits the retrieval of embedded sensitive data. The vulnerability is a direct disclosure of confidential information, aligning with CWE‑497, and can compromise the confidentiality of data meant to be restricted.

WordPress sites using the WP Google Analytics Events plugin by yuvalo are vulnerable if they run version 2.8.2 or any earlier release. All installations, regardless of other security controls, are impacted until a newer version is available.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS value of less than 1 % reflects a low likelihood of exploitation at the time of analysis. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can obtain the embedded sensitive data by accessing any page that loads the plugin, potentially without needing authentication.