The Vulnerability is an Insertion of Sensitive Information Into Sent Data flaw in the QuarkA QA Analytics plugin. It allows an attacker or unauthenticated user to retrieve embedded sensitive data that the plugin inadvertently transmits. The flaw can lead to disclosure of confidential information, potentially compromising user privacy and data integrity.

The affected system is the WordPress QA Analytics plugin, QuarkA’s QA Analytics package. All installed versions up to and including 5.3.0.0 are vulnerable; the vulnerability exists in every revision from the initial release through 5.3.0.0.

The CVSS score of 6.9 indicates a medium to high severity data exposure risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s normal operation on a WordPress site where it sends analytics data, enabling a malicious actor with the ability to request or observe these transmissions to gain sensitive information. No additional exploitation conditions are described in the CVE data.