An attacker can retrieve sensitive information that the RepairBuddy plugin inserts into outbound data. This results in the unauthorized disclosure of confidential site data, exemplifying a CWE‑201 weakness where sensitive data is exposed through normal data transmission. The compromise of such data can erode user trust and potentially violate privacy regulations if personal or financial details are involved.

The vulnerability affects the RepairBuddy plugin developed by Ateeq Rafeeq. All installations running version 4.1132 or earlier are impacted. No later versions are mentioned as affected.

The CVSS score of 5.3 indicates moderate severity. The likelihood of exploitation is low, as the EPSS value is below 1 percent, and the vulnerability is not listed in the CISA KEV catalog. Likely, an attacker would access the site’s public interface and trigger the plugin’s normal operation, which could lead to exposure of the hidden data. No special conditions are required beyond the presence of the vulnerable plugin on a public WordPress site.