The vulnerability arises from the insertion of sensitive information into data that is transmitted or displayed by the Booking Ultra Pro plugin. As a result, embedded sensitive data can be retrieved by attackers, effectively exposing confidential information. This is a classic case of information exposure through improper data handling (CWE-201).

The affected product is Deetronix's Booking Ultra Pro WordPress plugin. All releases from the earliest available version up to and including 1.1.23 are impacted. The exact lower boundary is unspecified, but any installation using 1.1.23 or earlier may be vulnerable.

The CVSS score of 6.5 indicates a moderate severity rating. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves invoking vulnerable plugin functionality, which may be accessed by authenticated users or, in some configurations, publicly. An attacker could trigger the exposure by interacting with the plugin's data handling flows, potentially leaking sensitive details.