CVE-2025-68014 describes a vulnerability in the AweBooking plugin by awethemes where sensitive information can be inserted into data sent by the application, allowing an attacker to retrieve embedded sensitive data. This affects AweBooking versions up to 3.2.26. The vulnerability has a CVSS 3.1 base score of 6.5, with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality but not integrity or availability. There is no vendor advisory or patch information available, and no known exploits have been reported.

The vulnerability allows unauthorized retrieval of sensitive information embedded in sent data, potentially exposing confidential data. The impact is limited to confidentiality with no reported effects on integrity or availability. The attack can be performed remotely over the network with low complexity and requires only low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from awethemes and apply any future patches promptly. Until a fix is available, consider limiting exposure of the affected plugin or restricting access to trusted users only.