This vulnerability (CWE-532) in the Octolize USPS Shipping for WooCommerce – Live Rates plugin allows sensitive information to be written into log files. The affected versions include all releases up to 1.9.4. The issue could potentially expose confidential data through logs accessible to unauthorized parties. The CVSS 3.1 score of 5.3 reflects a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only. No official fix or vendor advisory has been published yet, and no exploits are known in the wild.

The vulnerability may lead to the exposure of sensitive information through log files, which could be accessed by unauthorized users if logs are not properly secured. This exposure impacts confidentiality but does not affect integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and restrict access to log files generated by the plugin to prevent unauthorized disclosure of sensitive data. Monitoring for updates from the vendor is recommended.