A flaw in the WordPress Cargus eCommerce plugin allows sensitive data to be embedded in transmitted data streams. The vulnerability permits an attacker to retrieve confidential information that should remain private. The weakness is categorized as CWE‑201, which focuses on the improper handling of sensitive information.

All installations of the Cargus plugin with a version number of 1.5.8 or earlier are affected. The vulnerability applies to any WordPress site that has not upgraded beyond this release checkpoint.

The CVSS score of 5.3 indicates a medium severity level. An EPSS score of less than 1% suggests a low exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that a remote web request to the plugin’s endpoints could trigger the vulnerability, enabling an unauthenticated adversary to obtain embedded sensitive information without requiring prior compromise or elevated privileges.