The vulnerability is described as an exposure of sensitive system information to an unauthorized control sphere, and it is assigned CWE‑497, which indicates improper restriction of data that is meant to remain confidential. An attacker who can exercise the affected functionality could view protected data within the WordPress environment. The impact is a loss of confidentiality; the data does not indicate the ability to execute code or cause a denial of service.

The flaw exists in the WordPress plugin "Macro Calculator with Admin Email Optin & Data" for all releases up to and including version 1.0. The CNA lists the vendor as "NotFound", and the plugin is available in the WordPress plugin repository, meaning any WordPress site that has installed this plugin with a version equal to or lower than 1.0 is vulnerable.

The CVSS base score of 7.5 places the vulnerability in the high‑severity range, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the current landscape. It is not listed in CISA’s KEV catalog, so there are no known mass exploits for the issue. The attack vector is inferred to be local to the WordPress site or require the attacker to interact with the plugin’s interface; no direct evidence of remote exploitation is provided in the description.