This vulnerability allows the YITH WooCommerce Subscription plugin to reveal embedded sensitive data that should remain confidential. The weakness is a case of insecure data handling, classified as CWE-497, where sensitive system information is improperly exposed to unauthorized parties.

The affected product is the YITH WooCommerce Subscription plugin for WordPress, any release from the earliest version up to and including version 4.22.0. All WordPress sites that have this plugin installed and have not yet upgraded to a version later than 4.22.0 are potentially vulnerable.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in CISA's KEV catalog. Attackers could exploit this flaw by accessing plugin-provided data or endpoints that expose sensitive information; while the exact attack vector is not specified, it is likely that the vulnerability can be triggered by users interacting with the plugin's interface, potentially without authentication. The vulnerability can be leveraged to compromise confidentiality of system or customer data.