The vulnerability identified as CVE-2025-68040 affects the weDevs WP Project Manager plugin for WordPress, specifically versions up to and including 3.0.1. It involves the insertion of sensitive information into data sent by the application, which can then be retrieved by an attacker. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges, without user interaction. The impact is high on confidentiality, with no impact on integrity or availability. No patch or official vendor advisory is currently available to confirm remediation status.

An attacker with network access and low privileges can exploit this vulnerability to retrieve sensitive information embedded in sent data from the WP Project Manager plugin. This compromises the confidentiality of sensitive data managed by the plugin. There is no indication of impact on data integrity or system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected plugin and monitor for updates from weDevs. Avoid exposing the plugin to untrusted networks where possible.