The ElasticPress plugin for WordPress contains a CWE‑201 Sensitive Information Exposure vulnerability: insertion of sensitive information into data sent by the plugin, allowing an attacker to retrieve embedded sensitive data. This flaw results in the unintended disclosure of confidential information and permits exfiltration of data from the plugin’s data streams.

The affected product is the ElasticPress plugin from 10up, versions up through 5.3.4. Any WordPress site using these versions is vulnerable and needs to be upgraded.

The CVSS score of 5.3 indicates a moderate severity for data exposure, while the EPSS score is less than 1 at this time. The issue is not listed in the KEV catalog, implying no documented, actively exploited cases yet. Based on the description, it is inferred that exploitation requires the plugin to process or expose data, so attackers would need either direct access or the ability to trigger the specific data‑handling functionality that leaks the information. The lack of a publicly known exploit reduces immediate risk, but the moderate CVSS score warrants remediation.