The vulnerability allows attackers to read or download sensitive information that the Link Whisper Free plugin writes to files or directories that are publicly accessible. This data may include internal configurations, paths, or other content that could assist an attacker in further compromising the site. The weakness is classified as CWE‑538 and can expose confidential data to anyone who can reach the relevant URLs.

WordPress sites that have installed the free Link Whisper plugin, version 0.7.7 or earlier. Any instance of the plugin carried by Spencer Haws that has not been upgraded beyond 0.7.7 is affected.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur via the web interface of the affected WordPress site, where the attacker could request the publicly exposed file paths written by the plugin. No special user privileges are required beyond the ability to access the site’s file system through normal HTTP requests.