An Injection of Sensitive Information Into Sent Data vulnerability in the WPVibes Elementor Addon Elements plugin allows the extraction of embedded sensitive data. This flaw can lead to the accidental or malicious disclosure of confidential information such as user credentials, administrative data, or other sensitive site content. Attacking actors can exploit the weakness to gather data that is otherwise intended to be protected, thereby breaching the confidentiality of the WordPress installation. The weakness is classified as CWE-201, which denotes information exposure through improper handling of sensitive data.

The affected product is the WPVibes Elementor Addon Elements plugin for WordPress. Vulnerable versions include all releases from the initial version up to and including 1.15. No other vendors or product variants are currently identified. The plugin can be installed on any WordPress site that utilizes Elementor for page building. On such sites, if the plugin is active, an attacker who can trigger the data retrieval functionalities may expose sensitive information stored within the plugin.

The CVSS score of 5.3 places this vulnerability in the medium severity range, indicating that exploitation is possible but may require certain conditions to be met. EPSS data for this issue is not available, and it is not listed in the CISA KEV catalog, suggesting that there may be no known widespread exploitation currently. The exploit likely relies on the ability to invoke the plugin’s data retrieval mechanisms, which could be achieved remotely via crafted HTTP requests or indirectly by authenticated users with editing privileges. Administrators should assess whether publicly exposed endpoints or privileged users could precipitate exploitation.