Active Products Tables EUVD-2026-98367

Requires the Active Products Tables for WooCommerce plugin (version 2.1.3 or earlier) to be installed and active on a WordPress/WooCommerce site, with its product-table output exposed to clients - the default purpose of the plugin. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed, so any visitor who can reach the rendered table can retrieve the embedded data. Limiting factors: impact is confined to LOW confidentiality (C:L) with no integrity or availability effect, the exact sensitive fields disclosed are unspecified, and only sites actually running this specific plugin are affected, bounding real-world exposure despite the unauthenticated network vector.

This is a moderate-severity information disclosure issue (CWE-201) scored CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low attack complexity, no privileges and no user interaction, but only LOW confidentiality impact and no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: the unauthenticated network vector keeps this easy to reach, but the single LOW confidentiality impact (embedded/sensitive data leaked via sent data, not a full credential or database dump) caps real-world severity. Only one source (Patchstack) is present and there is no independent SSVC or automatability data, so the sophistication of exploitation cannot be judged. Net: a genuine but low-to-moderate priority issue - easy to trigger yet limited in what it exposes - not a critical emergency absent evidence of active exploitation or a high-value data leak.

A remote, unauthenticated attacker interacts with a WooCommerce store running the Active Products Tables plugin (≤2.1.3) and requests the product-table output, which embeds sensitive product/backend data not intended for public display. The attacker parses the returned data to retrieve the embedded sensitive information. No public exploit code was identified, and the low attack complexity (AC:L) means no special timing or conditions are needed once the vulnerable endpoint is reachable.