The vulnerability allows unauthenticated users to access sensitive information stored by the Byteflows Travel & Hotel Booking plugin. According to the official description, this flaw is an instance of CWE‑497, which denotes unauthorized disclosure of data. Because no authentication is required, an attacker can read confidential data directly from the website, resulting in a confidentiality breach that could compromise user privacy and business secrets.

Affected systems include the WordPress Byteflows Travel & Hotel Booking plugin, developed by Byteflows. Versions up to 1.0.0 are vulnerable. A patch is available in version 1.0.1 and later, which resolves the issue.

The CVSS score of 7.5 signals a high severity; the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been observed being actively exploited. The attack vector is unauthenticated, meaning any visitor with access to the affected site could trigger the data disclosure, provided the plugin exposes the relevant endpoints. Because the flaw does not require user credentials or elevated privileges, the risk of exploitation is relatively high in a public-facing environment. The combination of these factors warrants prompt remediation.