The identified flaw allows an attacker to retrieve embedded sensitive data from the WordPress Fraud Prevention For Woocommerce plugin. The exposure jeopardizes the confidentiality of credentials and configuration information that may be stored by the plugin, leading to potential compromise of the entire WordPress installation. The weakness is classified as CWE-497, indicating that sensitive data can be read without proper access controls.

The vulnerability affects the Fraud Prevention For Woocommerce plugin developed by Dotstore, specifically all releases up to and including version 2.3.2. Users running any of these versions on a WordPress site are vulnerable until the plugin is updated.

With a CVSS score of 4.3 the issue is considered moderate and the EPSS score is below 1%, indicating a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to obtain administrative access to the WordPress backend or exploit other authenticated paths that allow interaction with the plugin’s embedded data, since no unauthenticated access is reported.