The vulnerability is described as an insertion of sensitive information into sent data within the StylemixThemes MasterStudy LMS Pro plugin. An attacker able to trigger the plugin’s output can retrieve embedded sensitive data, such as personal or payment details, from the responses generated by the plugin. This weakness is identified as CWE‑201, indicating that sensitive information is exposed in an uncontrolled manner, potentially compromising confidentiality.

The affected product is MasterStudy LMS Pro by StylemixThemes. All releases from the initial version up to, but not including, 4.7.16 are impacted.

The CVSS score of 7.5 reflects a moderate to high severity. An EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through web interactions with the plugin; any user capable of issuing requests that invoke the plugin’s output (for example, API calls or page rendering) may be able to access the sensitive data. No active exploit code has been reported, but the data leakage can be exercised by simply sending the relevant request.