This vulnerability in WPDB to Sql (<= 1.2) allows an unauthenticated attacker to retrieve embedded sensitive information by exploiting the insertion of sensitive data into sent data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild, and no patch or mitigation details have been provided by the vendor or advisory sources.

An attacker can remotely retrieve sensitive information embedded in data sent by the WPDB to Sql plugin, potentially exposing confidential data. This compromises confidentiality but does not affect data integrity or system availability. The vulnerability can be exploited without authentication or user interaction, increasing the risk of exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the affected plugin by restricting access or disabling it if feasible. Monitor vendor channels for updates regarding patches or official mitigations.