The vulnerability is a sensitive data exposure issue in the WordPress WPPizza plugin, allowing an attacker to access subscriber information in versions 3.19.9 and earlier. This weakness falls under CWE‑497, meaning that confidential data is stored or transmitted insecurely. The impact is that unauthorized users could obtain personal data such as names, addresses, phone numbers, and payment details, potentially leading to privacy violations, phishing, or other downstream attacks. No evidence suggests that an attacker can gain code execution or modify site content; the confidentiality of subscriber data is the primary concern.

The affected product is the WPPizza plugin developed by ollybach. All releases up to and including version 3.19.9 are vulnerable. Users and site administrators should verify that the plugin is not present in these versions to assess risk.

The CVSS score of 6.5 classifies the vulnerability as a medium severity finding. The EPSS score of less than 1% indicates a very low probability that the vulnerability has been actively exploited at present. The vulnerability is not listed in CISA’s KEV catalog, implying it is not known to be widely abused. The likely attack vector is a web-based request to the plugin’s endpoints or data retrieval pages, but specific exploit details are not provided in the CVE description, so the true ease of exploitation remains uncertain.