The plugin contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows attackers to retrieve embedded sensitive data, leading to a breach of confidentiality. This weakness aligns with CWE-201 and can expose user information through the plugin’s output.

The vulnerability affects WordPress sites that utilize the RT-Theme 18 | Extensions plugin from any unreleased version up to and including 2.5. All users of this plugin should review their deployment and ensure the plugin is updated to a patched release.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of spontaneous exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating limited current exploitation activity. The likely attack vector would involve sending crafted HTTP requests to the plugin’s endpoints, triggering the disclosure of sensitive data. Because the plugin operates within the WordPress environment, sites with publicly accessible endpoints may be exposed without additional authentication or privilege requirements.