The vulnerability identified as CVE-2026-32354 affects the magepeopleteam WpEvently plugin for WordPress, specifically versions prior to 5.1.9. It allows an attacker to insert sensitive information into data sent by the plugin, potentially enabling unauthorized retrieval of embedded sensitive data. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently referenced, and no exploits are known to be active.

An attacker can retrieve sensitive information embedded in data sent by the vulnerable WpEvently plugin, potentially leading to unauthorized disclosure of confidential data. The impact is limited to confidentiality with no effect on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor magepeopleteam communications for updates. Until a fix is available, consider limiting exposure of the affected plugin or disabling it if sensitive data exposure risk is unacceptable.