The plugin contains an insertion of sensitive information into sent data, allowing an attacker to retrieve embedded sensitive data. This vulnerability is classified as CWE-201 and can expose confidential information that may be used for malicious purposes, including credential theft, fraud, or further exploitation.

All installations of the Five Star Restaurant Reservations WordPress plugin through version 2.7.24, as well as any older releases that remain in use, are affected. The plugin is distributed by Etoile Web Design Incorporated and is used within WordPress sites that manage restaurant reservations.

The CVSS score of 7.5 indicates high impact severity. Because EPSS data is not available, the precise likelihood of exploitation cannot be quantified, and the lack of a KEV listing suggests the vulnerability has not yet been widely exploited. Based on the description, it is inferred that an attacker could send specially crafted requests to the plugin’s endpoints—possibly via a web browser or automated tool—to trigger leakage of sensitive data. Based on the description, it is inferred that the attacker does not need privileged access to the host system; the flaw can be triggered from the application perimeter.