The PowerBI Embed Reports plugin for WordPress contains an authentication bypass that allows attackers to call the 'testUser' endpoint without credentials. This endpoint returns Azure Active Directory user details, including personal identifiable information such as display name, email address, phone numbers, and department. In addition, the response exposes OAuth error data that contains application and client identifiers, error codes, trace identifiers, and correlation identifiers. The disclosure of this data violates user confidentiality and can assist attackers in gathering intelligence or pursuing further compromise.

The vulnerability affects the PowerBI Embed Reports plugin developed by cyberlord92, in all releases up to and including version 1.2.0. Any WordPress site that has installed this plugin and has not applied a newer release that fixes the flaw is at risk.

With a CVSS score of 5.3, the flaw is categorized as medium severity; however, the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Attackers can trigger the issue by issuing an unauthenticated request to the 'mo_epbr_admin_observer' endpoint, which is accessible via the 'init' hook. The lack of capability checks allows any user, including anonymous visitors, to retrieve sensitive Azure AD data.