Pie Register plugin version 3.8.4.13 and earlier contains an insertion of sensitive information into data that can be sent back to an attacker. The flaw allows the retrieval of embedded sensitive data, which could be used to compromise account credentials or other confidential information stored within the plugin. The weakness is classified as CWE-201, indicating a failure to protect data during transmission.

The plugin belongs to the Shamim Rajani Pie Register plugin, which is distributed for WordPress sites. All installations using Pie Register version 3.8.4.13 or earlier are impacted. Versions starting at 3.8.4.14 contain the fix and are not affected.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the issue by triggering the plugin’s data‑sending functionality, most likely through normal web requests to WordPress endpoints. The exact prerequisites for exploitation are not detailed in the advisory, but it is inferred that the attack could occur from a web‑facing interface where plugin data is processed.