The Shelf Planner plugin for WordPress was found to expose sensitive information through publicly accessible log files. An attacker who can reach the web directory can read log contents that may contain credentials, user data, or system configuration details. This vulnerability falls under CWE-538, which describes information exposure through logs.

The issue affects Shelf Planner Inventory Management for WooCommerce plugin versions up to and including 2.8.1. Users who are running any of these versions and have not applied recent updates are at risk.

The vulnerability carries a CVSS score of 5.3, placing it in the moderate severity range, and an EPSS score of less than 1%, indicating a low likelihood of immediate exploitation. It is not listed in CISA's KEV catalog. Because the attack requires no authentication and relies on openly accessible files, vulnerable sites can be compromised from any external location by simply navigating to the log path.