AweBooking, a WordPress booking plugin, contains a flaw that causes sensitive information to be unintentionally embedded in data sent to site users. This leads to the disclosure of personal or confidential data through normal use of the plugin. The vulnerability aligns with CWE‑201, which addresses the improper segregation and handling of sensitive data.

WordPress sites that use the AweThemes AweBooking plugin with a version of 3.2.26 or earlier. Any installation within that range is susceptible, regardless of specific plugin settings.

The CVSS score of 6.5 places the flaw in the medium severity category. The likely attack vector is a local or web‑based approach that requires the attacker to invoke the plugin’s output or otherwise access the website’s interface; this inference comes from the plugin’s normal operation, as the CVE description does not explicitly state the vector. The EPSS score of less than 1 percent indicates a low but non‑zero probability of exploitation with publicly available tools. Since the vulnerability is not listed in CISA’s KEV catalog, no widespread exploitation has been reported to date, but the potential for privacy loss justifies high‑priority remediation.