The Infinite Uploads plugin contains a flaw that injects sensitive information into data that is transmitted from the server when a user interacts with the upload feature. This vulnerability can allow an attacker to retrieve embedded sensitive data that was not intended for public disclosure, matching CWE‑201 Intentional Data Exposure. The impact is a loss of confidentiality as confidential information could be exposed to unauthorized parties.

Affected by this flaw are installations of the WordPress Infinite Uploads plugin from any version up to and including 3.4.1, developed by ClikIT. The vulnerability applies to all sites that have not upgraded beyond 3.4.1, regardless of WordPress configuration or other plugins, because the flaw resides in the plugin code itself.

The CVSS score of 6.5 indicates moderate risk, and the EPSS score is currently unavailable, so it is unclear how frequently this vulnerability is being exploited. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is via the plugin’s web interface; an attacker with access or the ability to send crafted requests to the upload endpoint could trigger the data exposure. Updating to version 3.4.2 or later removes the flaw, and no known exploits are reported in public sources at this time.