The vulnerability allows an attacker to obtain sensitive information without authentication. Classified as CWE-201, this flaw resides in Vitepos versions up to 3.4.2, enabling exposure of customer and transaction data that should be protected. The main consequence is loss of confidentiality, potentially compromising customer privacy and violating data protection regulations.

WordPress sites that have the Vitepos plugin installed with a version older than 3.4.3, as distributed by the vendor Appsbd. Any WordPress installation using Vitepos <= 3.4.2 is at risk.

The CVSS score of 7.5 indicates a high severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is unauthenticated access to plugin endpoints or configuration pages, which an attacker can use to retrieve exposed data. No additional prerequisites are stated, so the vulnerability can potentially be exploited by any internet‑connected user.