The vulnerability identified as CVE-2025-68515 affects the WP Booking System plugin by Roland Murg. It involves the insertion of sensitive information into data sent by the system, which can be retrieved by an attacker. The issue impacts versions up to 2.0.19.12. The CVSS 3.1 vector indicates the attack can be performed remotely without authentication or user interaction, with a scope change and limited confidentiality impact. No official patch or remediation details are provided in the available data.

An attacker can remotely retrieve sensitive information embedded in the data sent by the WP Booking System plugin without requiring privileges or user interaction. The confidentiality impact is limited, and there is no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive data handled by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider limiting exposure of the affected plugin or disabling it if sensitive data exposure risk is unacceptable.