The vulnerability identified as CVE-2025-68515 affects the Roland Murg WP Booking System plugin for WordPress, versions up to 2.0.19.12. It involves insertion of sensitive information into data sent by the system, which can be retrieved by an attacker. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, and it results in partial confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild. No patch or vendor advisory information is currently available.

An attacker can remotely retrieve sensitive information embedded in data sent by the WP Booking System plugin, potentially exposing confidential data. The vulnerability does not affect data integrity or availability. The medium severity score reflects the confidentiality impact and ease of exploitation without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the affected plugin or disabling it if sensitive data exposure risk is unacceptable.