Technical impact
The vulnerability allows an attacker to retrieve embedded sensitive data from the KI Live Video Conferences plugin on WordPress sites. It is classified as a Sensitive Data Exposure flaw, represented by CWE‑497, and can lead to unauthorized disclosure of system information to a control sphere that was not intended to receive it.
Affected Systems
The flaw affects the KI Live Video Conferences plugin provided by whassan. All installed versions up to and including 5.5.15 are vulnerable. Versions prior to 5.5.15 are not mentioned as affected.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through normal plugin functionality—perhaps via a publicly accessible page or API that displays sensitive data—since the description cites an unauthorized control sphere. No additional conditions are stated, so the risk remains moderate with low probability of exploitation.
EUVD