VPSUForm v-form for WordPress is susceptible to an exposure of sensitive system information. The flaw permits an unauthorized party to retrieve embedded sensitive data that should normally remain protected, leading to a breach of confidentiality.

WordPress sites that have installed the VPSUForm plugin version 3.2.24 or earlier are affected. The plugin, produced by Vikas Ratudi, remains compromised until a newer release or patch is applied. All users running any early or intermediate versions of VPSUForm from its initial release through 3.2.24 are potentially exposed.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, implying no widespread exploits are currently known. Likely exploitation occurs through the web interface of the affected WordPress site, where an attacker can send crafted requests to the plugin’s endpoints to harvest the sensitive data.