This vulnerability (CVE-2026-42379) in WPDeveloper Templately involves CWE-201, which is the insertion of sensitive information into sent data. It allows an attacker with low privileges to retrieve embedded sensitive data sent by the plugin. The vulnerability affects all versions up to 3.6.1. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, and it results in a complete confidentiality breach without affecting integrity or availability. No official fix or patch has been published yet, and the vendor has not provided remediation guidance.

An attacker with low privileges can remotely retrieve sensitive information embedded in data sent by the Templately plugin, leading to a complete loss of confidentiality. There is no impact on data integrity or system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting access privileges to trusted users only and monitor for any suspicious activity related to data exposure. Avoid exposing the plugin to untrusted networks if possible.