The FloristPress plugin contains an insertion of sensitive information into sent data vulnerability that allows an attacker to retrieve embedded sensitive data. This is a confidentiality issue that can expose business‑critical information, but does not provide code execution or denial of service. The weakness is identified by CWE‑201.

The BAKKBONE Australia FloristPress plugin, version 7.8.4 and all earlier releases, are affected. Versions starting with 7.8.5 contain the fix and are not vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating high impact if exploited. The EPSS score is not available, and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attack vector could be remote, through normal WordPress administrative interactions or specially crafted requests that trigger sensitive data transmission. An attacker with access to the affected plugin, or potentially an authenticated WordPress user, could extract confidential information.