CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
What the vulnerability does
Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
WP AI CoPilot versions 1.2.7 and earlier expose sensitive information to authenticated users with low privileges. The vulnerability allows an attacker with a basic user account to read data they should not have access to across the site. The scope of impact extends beyond the plugin itself. Update to a version newer than 1.2.7.
What an attacker can do
Read sensitive information accessible to other users or parts of the site.
Potential impact on your site
User data and site information may be exposed to low-privilege accounts that should not see it.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
