The issue is an insertion of sensitive information into data that is sent to users. It allows an attacker to retrieve embedded sensitive data such as credentials or private information. The weakness is classified as CWE‑201, indicating that confidentiality of data is at risk when it is inadvertently exposed to the client.

The vulnerability affects the weDevs WP Project Manager WordPress plugin, versions from the earliest available release through 3.0.1 inclusive. Any WordPress site running any of those versions is potentially impacted.

The CVSS base score of 6.5 rates the vulnerability as moderate. The EPSS score is less than 1 %, indicating a very low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. The exact attack vector is not detailed in the advisory, but the vulnerability is likely triggered by interacting with plugin input fields or endpoints that expose data in responses. An attacker who can reach the site would be able to recover sensitive data leaked by the plugin.