This vulnerability (CVE-2026-61945) in MultiVendorX WooCommerce Product Stock Alert involves exposure of sensitive system information (CWE-497) to an unauthorized control sphere. It allows an attacker with network access and low privileges to retrieve embedded sensitive data without requiring user interaction. The affected versions include all versions up to 3.0.6. No official patch or remediation guidance is currently available from the vendor or advisory sources.

An attacker with low privileges can remotely access sensitive system information embedded in the product, potentially leading to information disclosure. The vulnerability does not affect integrity or availability but impacts confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Restricting access to the affected plugin and limiting privileges may reduce exposure risk until a patch is available.