This vulnerability arises from a flaw in the Premio Chaty WordPress plugin that permits sensitive information to be inserted into and subsequently retrieved from chat data. The defect directly compromises confidential data handled by the chat interface, potentially exposing credentials, personal identifiers, or other privileged information back to the attacker.

WordPress sites that have installed the Premio Chaty plugin version 3.5.1 or earlier are compromised, as the issue exists in all releases up to and including 3.5.1.

The CVSS score of 7.5 reflects moderate‑to‑high severity, while an EPSS score of less than 1 % indicates the likelihood of widespread exploitation is low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is inferred to occur when an attacker can interact with the chat interface—either by accessing an account that uses the plugin or through cross‑site inputs—allowing them to retrieve embedded sensitive data.