What is the CVSS score of CVE-2025-59136?

CVE-2025-59136 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-59136?

Yes, a public proof-of-concept exploit is available for CVE-2025-59136. Prioritise patching immediately. EPSS: 0.0%.

Wordpress Plugin CVE-2025-59136

MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-12-31 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.

AnalysisAI

The Efí Bank Gerencianet Oficial WordPress plugin through version 3.1.3 exposes sensitive data by embedding it into sent HTTP requests or responses, allowing attackers to retrieve payment-related information without authentication. This information disclosure vulnerability (CWE-201) affects all installations of the affected plugin versions and is classified as low-risk based on EPSS score (0.04%, 12th percentile), with no public exploit code or active exploitation confirmed.

Technical ContextAI

The vulnerability stems from improper handling of sensitive information in the Gerencianet payment gateway integration plugin for WooCommerce. CWE-201 describes the insertion of sensitive data into outbound communications-in this case, likely API requests, log files, or client-side transmitted data related to payment processing. The plugin integrates with Efí Bank's payment infrastructure, and the flaw allows sensitive payment details (potentially API keys, tokens, transaction data, or customer information) to be exposed in network traffic or stored data that an attacker can access. The vulnerability affects the woo-gerencianet-official WordPress plugin CPE (wp:plugin:woo-gerencianet-official) across versions up to and including 3.1.3.

Affected ProductsAI

The Efí Bank Gerencianet Oficial WordPress plugin (woo-gerencianet-official) is affected in all versions from the earliest through version 3.1.3. This is a WooCommerce payment gateway extension distributed via the WordPress Plugin Directory. Installations of this plugin on any WordPress site with WooCommerce are vulnerable if not updated beyond version 3.1.3.

RemediationAI

Update the Gerencianet Oficial plugin to the latest available version beyond 3.1.3. Site administrators should immediately navigate to WordPress Admin Dashboard > Plugins > Installed Plugins, locate 'Gerencianet Oficial', and click 'Update' to apply the patched version. Additionally, review server logs and API request history to ensure no sensitive payment data (API keys, tokens, transaction IDs) has been exposed or logged in plaintext; rotate any API credentials that may have been embedded in requests. Verify that sensitive data is not cached in browser history or proxy logs. For detailed remediation guidance and patch availability confirmation, refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/woo-gerencianet-official/vulnerability/wordpress-gerencianet-oficial-plugin-3-1-3-sensitive-data-exposure-vulnerability.