The vulnerability identified as CVE-2025-24567 affects the WP Mailster plugin by brandtoss, allowing an attacker with low privileges and network access to retrieve sensitive information embedded in sent data. This issue impacts all versions up to and including 1.8.16.0. The CVSS 3.1 vector indicates that the attack complexity is low, no user interaction is required, and the confidentiality impact is high, while integrity and availability are not affected. No patch or vendor advisory is currently provided, and the product is not a cloud service.

An attacker with low privileges and network access can retrieve sensitive information embedded in data sent by the WP Mailster plugin. This compromises confidentiality but does not affect integrity or availability. The vulnerability may expose sensitive data to unauthorized parties, potentially leading to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected plugin and monitor for unusual data exposure. Avoid deploying this plugin in sensitive environments without additional protective controls.