The 12 Step Meeting List plugin for WordPress contains a flaw that causes sensitive information to be unknowingly included in data that the plugin transmits or exposes to external entities. This can allow attackers to retrieve confidential data that should remain private. The vulnerability corresponds to CWE-201, indicating information exposure to an unauthorized actor. The potential damage includes the disclosure of personal or meeting details that could compromise confidentiality.

The problem affects the AA Web Servant 12 Step Meeting List WordPress plugin, versions up to and including 3.19.9. Any WordPress site that has installed the plugin and has not applied a later update is at risk.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The plugin is web‑based, so the attack vector is likely remote via HTTP requests, allowing attackers to trigger the problematic functionality from outside the site. No additional prerequisites are stated beyond the plugin being active on a publicly reachable WordPress installation.