This vulnerability, identified as CWE-201 (Insertion of Sensitive Information Into Sent Data), affects VillaTheme Notivo versions up to 1.4.2. It allows unauthenticated attackers to gain access to sensitive information that is improperly inserted into data sent by the application. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild, and no patch or vendor advisory details are provided.

The impact is limited to confidentiality as sensitive information may be exposed without authentication. There is no impact on integrity or availability. The vulnerability could allow attackers to obtain sensitive data that should not be disclosed, potentially leading to information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor VillaTheme's advisories for updates. Until a fix is available, consider restricting access to the affected Notivo versions and reviewing data handling configurations to minimize sensitive data exposure.