This vulnerability (CVE-2026-54197) affects Wpmet's GetGenie plugin, specifically versions up to and including 4.4.1. It is categorized under CWE-201, which involves the insertion of sensitive information into sent data. The flaw allows unauthenticated attackers to expose sensitive data by manipulating the data sent by the application. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. The impact affects integrity and availability but not confidentiality. No vendor advisory or patch information is currently available, and no exploits have been observed in the wild.

The vulnerability allows unauthenticated attackers to insert sensitive information into data sent by the GetGenie plugin, potentially leading to sensitive data exposure. The CVSS score of 6.5 reflects a medium severity with impacts on data integrity and availability. Confidentiality is not impacted according to the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor for vendor updates and apply patches once available. Until then, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.