Layman's description of the padding oracle attack
Quoting the answer here:

Padding Oracle attacks are mainly a problem in cases, where e.g. an encrypted message is modified and send to a target. These attacks try to measure the difference when decrypting and validating the message.
The steps are:

decrypting the message
checking the padding &gt; error if wrong
checking or processing the data &gt; error if wrong or format corruption detected

The padding oracle attacks try to measure timing differences between step (2) and (3) or utilizes different error messages.

So the information leakage that enables the attack comes in the form of either timing differences or is present in the error messages that the server returns as a response to the malicious query.