The WP Messiah WP AI CoPilot plugin versions up to and including 1.2.7 contain a vulnerability where sensitive information can be inserted into data sent by the plugin, allowing retrieval of embedded sensitive data. This issue affects the confidentiality of data handled by the plugin. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and low privileges, without user interaction, and results in a confidentiality impact with a changed security scope. No vendor advisory or patch information is provided, and the vulnerability is currently published without known exploits in the wild.

The vulnerability impacts confidentiality by allowing an attacker to retrieve sensitive information embedded in data sent by the WP AI CoPilot plugin. There is no reported impact on integrity or availability. The scope of the vulnerability is changed, indicating that the attack affects resources beyond the initially vulnerable component. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor WP Messiah communications for updates and consider limiting exposure of the affected plugin until a fix is available.