The Simple Price Calculator plugin by premiumbizthemes, versions up to and including 1.3, contains a vulnerability identified as CVE-2025-58872. This issue involves the insertion of sensitive information into data sent by the plugin, allowing an attacker with low privileges to retrieve embedded sensitive data. The vulnerability does not require user interaction and impacts confidentiality without affecting integrity or availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can retrieve sensitive information embedded in data sent by the vulnerable Simple Price Calculator plugin. This compromises confidentiality but does not affect data integrity or system availability. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin or limiting privileges of users who can interact with it to reduce risk.