Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover plugin allows retrieval of embedded sensitive data. This vulnerability exposes confidential information that should remain private, potentially leading to data breaches. The weakness is classified as CWE‑201, indicating improper handling of sensitive data during transmission.

The affected product is the WordPress Smart Online Order for Clover plugin released by ZAYTECH, with vulnerable versions ranging from the earliest release up to and including version 1.6.0. Systems running WordPress with this plugin installed, regardless of other configurations, are susceptible.

The CVSS score of 7.3 reflects high severity, while the EPSS score is not available, making it unclear how frequently attackers are targeting this flaw. The vulnerability does not appear in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation. Based on the plugin's role in transmitting order data, the likely attack vector is a remote web‑based exploitation of the WordPress site, where an attacker can manipulate request parameters to trigger the exposure of sensitive information. Exploitation requires access to the site or an ability to send crafted requests to the plugin endpoint.