The vulnerability in the WooCommerce Ultimate Points And Rewards plugin allows an unauthorized user to retrieve embedded sensitive system information. The flaw stems from improper handling of data stored by the plugin, leading to a data disclosure that is classified as CWE-497. While the plugin functions normally, this weakness can expose user or system data to unauthenticated actors.

Affected systems are sites using the WPSwings WooCommerce Ultimate Points And Rewards plugin with versions n/a through 2.10.2. No later releases have been confirmed to contain the issue.

The CVSS score of 4.3 indicates a low‑to‑moderate impact, and the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and no obvious public exploitation has been reported. The likely attack vector is via an exposed plugin endpoint that can be accessed by users without authentication, allowing them to retrieve sensitive data. Because no patch is currently available, administrators should monitor for official updates and treat exposed data as potentially compromised.