The vulnerability identified as CVE-2025-49300 affects the Traveler Option Tree plugin by shinetheme, specifically versions up to 2.8. It involves the insertion of sensitive information into data sent by the plugin, which can be retrieved by an attacker. The CVSS score of 2.7 reflects a low impact, with confidentiality affected to a limited extent, no impact on integrity or availability, and requiring high privileges and network access. No vendor advisory or patch information is available to confirm remediation status.

The impact is limited to the potential disclosure of sensitive information embedded in data sent by the affected plugin. There is no reported impact on data integrity or system availability. Exploitation requires high privileges and network access, reducing the likelihood of widespread exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected plugin to trusted administrators and monitor for any unusual data exposure related to the plugin. Avoid exposing the plugin to untrusted networks where possible.