A flaw in the WordPress Templately plugin allows the insertion of sensitive information into data that is transmitted back to the requester. The vulnerability is classified as CWE‑201 and permits an attacker to retrieve embedded sensitive data, thus exposing confidential information that should not be publicly available.

The issue affects the WPDeveloper Templately plugin for WordPress, introducing the vulnerability in all releases up through and including version 3.6.1. Sites running any of these versions are at risk, regardless of the number of users or the level of access granted to the plugin.

The CVSS score of 7.7 describes a high severity data confidentiality impact. The EPSS score of less than one percent implies a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a request to the plugin’s endpoint or API that inadvertently returns sensitive data, potentially exploitable by anyone who can invoke that route. The threat primarily endangers data confidentiality rather than system integrity or availability.