The plugin contains a flaw that allows an attacker to gain access to embedded sensitive data. This vulnerability can lead to the disclosure of confidential information that the system stores or uses. The flaw is classified as a Sensitive Data Exposure defect, based on CWE-497, meaning data that should not be exposed is rendered available to users who do not have authorization.

SendPulse Email Marketing Newsletter plugin for WordPress is affected. Versions from the earliest available version through 2.2.1 are vulnerable. Administrators using any of these versions should check the plugin version and upgrade if possible.

The CVSS score of 4.3 places the issue in the low‑to‑moderate severity range. The EPSS score is under 1 %, indicating that the likelihood of exploitation is low, and the vulnerability is not listed in CISA's KEV catalog. Exploitation is likely to be possible through web requests to the plugin, meaning that any user who can trigger the plugin's exposed functionality or send crafted requests could retrieve sensitive data.