A WordPress plugin named SMTP Mailer from Noor Alam allows the insertion of sensitive information into outgoing email data. The vulnerability permits an attacker to retrieve embedded secrets, such as credentials or other confidential material, from the emails that the plugin sends. This leads to unauthorized disclosure of private data that the website owner or administrators intended to keep confidential.

The affected product is the WordPress SMTP Mailer plugin by Noor Alam. Versions up to and including 1.1.24 are vulnerable. Any WordPress installation using a version in this range might expose sensitive data through outgoing emails.

The vulnerability has a CVSS score of 7.5, indicating high severity, and is not listed in the CISA KEV catalog. The EPSS score is unavailable, so the exact probability of exploitation is uncertain, but the potential impact is significant. Based on the description, the likely attack vector is remote via the WordPress web interface or API that triggers email sending. An attacker who can cause the plugin to send an email would gain access to embedded secret data, potentially compromising user accounts or system credentials.