The vulnerability is an insertion of sensitive information into data that is sent by the Doofinder for WooCommerce plugin. As a result, sensitive data that should not be transmitted can be retrieved. The weakness corresponds to CWE-201 and can potentially expose confidential user information, compromising confidentiality and potentially enabling further attacks against the website’s users.

The affected component is the Doofinder for WooCommerce plugin for WordPress, with all releases from the earliest available version through 2.10.13 vulnerable. Site operators who have not upgraded beyond the stated maximum version are at risk.

The CVSS base score of 5.3 places the vulnerability in the medium severity range. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Likely exploitation would come from web traffic that interacts with the plugin’s checkout or search features, so the attack vector is probably network‑based. As no specific workaround is published, the primary defense is to apply the vendor update.