The Simple History plugin for WordPress contains an insertion of sensitive information into sent data. This flaw allows an attacker to retrieve data that was not intended for public exposure, such as administrative or configuration details. The weakness is categorized as CWE‑201 (Information Exposure) and can compromise the confidentiality of a site by leaking confidential data.

The vulnerability affects the Simple History plugin developed by Pär Thernström for WordPress. All releases up to and including version 5.24.0 are impacted. Sites using these versions are at risk if the plugin logs or data are accessible.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation. The attack vector is inferred to involve access to plugin logs or data records that the plugin exposes; an attacker who can read those logs or an authenticated user with sufficient privileges could potentially exploit the flaw. Although no confirmed exploits have been reported, the combination of moderate severity and low exploitation probability still warrants timely remediation.