The YS LeadGen plugin for WordPress is affected by a sensitive information exposure vulnerability in all versions up to and including 2.1.4. The issue arises because the AJAX action 'ysleadgen_get_captured_data' is accessible without authentication, enabling attackers to retrieve all captured form submission data. This includes personally identifiable information (PII) such as names, email addresses, and message content submitted through the plugin's forms. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an attack vector of network, no privileges required, and no user interaction needed.

An unauthenticated attacker can retrieve sensitive data collected by the YS LeadGen plugin, including PII such as names, email addresses, and message content. This exposure compromises user privacy and may lead to further privacy violations or targeted attacks. There is no indication of impact on integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AJAX action 'ysleadgen_get_captured_data' by implementing authentication or disabling the vulnerable functionality if possible.