The vulnerability in the magepeopleteam WpEvently WordPress plugin allows the insertion and subsequent retrieval of sensitive information within data that is transmitted by the plugin. This flaw falls under CWE-201 and directly undermines data confidentiality, potentially exposing private user or system information to unauthorized parties.

All installations of the WpEvently plugin by magepeopleteam with a version older than 5.1.9 are affected. The CVE notes the range as "from n/a through < 5.1.9", meaning every version prior to 5.1.9 is vulnerable; no specific sub‑versions are listed.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur via normal plugin usage or interaction with the plugin’s data sending functionality, as the flaw involves data being transmitted with unintended sensitive content. While no public exploits are noted, an attacker who can trigger the data transmission can read the embedded sensitive data.