The Web Accessibility by accessiBe WordPress plugin logs the entire configuration array to the browser console on every public page load when the widget is disabled. This logging occurs without any privilege checks or debug‑mode gating, allowing any visitor to view sensitive data such as email addresses, user IDs, account IDs, and license keys. The exposure is not limited to authenticated users; it is possible for any unauthenticated attacker to retrieve confidential configuration information via the browser console.

WordPress sites that installed the accessiBe plugin in any version up to and including 2.11. The vulnerability is present in all affected releases, with no distinguishing version among them. The plugin name is Web Accessibility by accessiBe.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated web attacker who simply visits the site and opens the browser console to inspect logged data. No special network access or credentials are required. Once the page loads, the sensitive data is exposed just by viewing the console output.