This vulnerability allows an unauthorized user to retrieve embedded sensitive data from the YITH WooCommerce Product Add-Ons plugin. The flaw is a sensitive data exposure, identified by CWE‑497. An attacker can read or exfiltrate private system information that the plugin stores or displays, leading to confidentiality loss.

Affects the YITH WooCommerce Product Add‑Ons plugin for WordPress versions up to and including 4.34.0. The issue applies to all installations of this plugin from the earliest version up to and including 4.34.0. No specific WordPress core or PHP version is mentioned, so any site using the listed plugin version is at risk.

The CVSS score of 5.3 indicates moderate risk. With no EPSS data, the probability of exploitation is unclear. The vulnerability is currently not listed in the CISA KEV catalog, so no current widespread exploitation is reported. The issue likely requires access to the administrative or exposed API endpoints of the plugin, meaning that an attacker with web access to the WordPress site and either authenticated or any client attempting to import data can trigger the data exposure.