CVE-2025-22303

Medium

Published: 07 January 2025

Published

07 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0016 36.4th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22303 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Wpmailster Wp Mailster. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the specific flaw in WP Mailster plugin that inserts sensitive information into sent data, preventing exploitation.

SI-15 Information Output Filtering good match

prevent

Filters information output from the plugin to prevent embedding and transmission of sensitive data to unauthenticated attackers.

AU-13 Monitoring for Information Disclosure good match

detect

Monitors plugin transmissions for unauthorized disclosure of embedded sensitive data, enabling identification of exploitation attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of public-facing WordPress plugin directly matches T1190 for sensitive data retrieval via information disclosure.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.17.0.

Deeper analysisAI

CVE-2025-22303 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the WP Mailster WordPress plugin (wp-mailster) developed by brandtoss. The issue affects all versions from n/a through 1.8.17.0 and allows attackers to retrieve embedded sensitive data. Published on 2025-01-07, it has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction or privileges required. Exploitation enables retrieval of embedded sensitive data sent by the plugin, without impacting integrity or availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-17-0-sensitive-data-exposure-vulnerability?_s_id=cve provides further details on this sensitive data exposure vulnerability in WP Mailster version 1.8.17.0.