The vulnerability identified as CVE-2026-62088 in 10up ElasticPress involves the insertion of sensitive information into data sent by the application, which can lead to the retrieval of embedded sensitive data. This issue affects ElasticPress versions up to 5.3.4. The CVSS 3.1 base score is 5.3, indicating a medium severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

The vulnerability may lead to unauthorized disclosure of sensitive information embedded in data sent by ElasticPress, potentially compromising confidentiality. There is no indication of impact on integrity or availability. The medium severity reflects a moderate risk of sensitive data exposure without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor vendor communications for updates and apply any official fixes once available.