Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay plugin allows attackers to retrieve embedded sensitive data. The flaw stems from inadequate handling of confidential information before it is transmitted, leading to unintended data exposure. As a result, attackers could obtain sensitive details such as user credentials or payment information, compromising user privacy and potentially serving as a foothold for further attacks. This weakness is classified as CWE‑201.

The vulnerability affects the WP EasyPay WordPress plugin provided by Saad Iqbal, versions from any release level up to and including 4.3.0. Any WordPress site that has installed or activated this plugin set to a version less than or equal to 4.3.0 is at risk.

The CVSS score of 5.3 places this issue in the moderate severity range, indicating that the potential impact is notable but not critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently not documented. The likely attack vector is remote, as an attacker could exploit the plugin through a web request to a WordPress site, eliciting responses that contain the exposed sensitive data. No specific prerequisites are noted beyond access to the site, meaning any visitor who can reach the plugin’s exposed endpoints could potentially be affected.