CVE-2025-67931CWE-201

CVE-2025-67931

High · published January 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

🚨 Sensitive information could be unintentionally sent with your data! The BulletProof Security plugin lets attackers retrieve sensitive info embedded in outgoing data, like a waiter accidentally spilling your secrets to the table next door! 🔥 Think of it like a restaurant where the waiter carries your order but also happens to share your personal conversations with others at the table — absolutely devastating! This vulnerability allows attackers to intercept sensitive data that shouldn’t be shared, just like a misplaced order could ruin a surprise party. An attacker could capture sensitive information sent through BulletProof Security, putting your users' data at serious risk. Imagine the fallout if personal details or secret messages fall into the wrong hands — it could lead to identity theft, unauthorized access, or even financial loss!

Put simply

Think of it like a restaurant where the waiter carries your order but also happens to share your personal conversations with others at the table — absolutely devastating! This vulnerability allows attackers to intercept sensitive data that shouldn’t be shared, just like a misplaced order could ruin a surprise party. This vulnerability in BulletProof Security allows unauthorized retrieval of sensitive information embedded in sent data. The flaw exists in versions up to 6.9, potentially exposing users to unwanted data leaks.

What to do

An attacker could capture sensitive information sent through BulletProof Security, putting your users' data at serious risk. Imagine the fallout if personal details or secret messages fall into the wrong hands — it could lead to identity theft, unauthorized access, or even financial loss! To defend against this vulnerability, update BulletProof Security to version 6.10 or later immediately. Review your data handling processes to ensure sensitive information isn’t inadvertently sent out. Lastly, consider implementing additional data encryption to safeguard communications. You've got this! Follow these steps, and you’ll ensure your users’ data remains confidential and secure! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.6th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-01-08T15:15Z
References (1)
EPSS history
Timeline
  • 08 JAN 09:17Z
    WordPress BulletProof Security plugin <= 6.9 - Sensitive Data Exposure vulnerability
    cvelistv5