The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature. This flaw allows users with a role as low as Contributor to access sensitive information, including session cookies of higher privileged users who view the affected content. The vulnerability is categorized under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) and CWE-200 (Information Exposure). The CVSS 3.1 base score is 6.8, indicating a medium severity with network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information such as session cookies belonging to higher privileged users. This could enable attackers with low-level roles to escalate privileges or impersonate other users, potentially compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict Contributor role access to the affected plugin features or disable the plugin if possible to prevent exploitation.