The vulnerability allows an unauthorized user to obtain embedded sensitive data stored by the Spotlight Social Media Feeds plugin. Because the plugin exposes system information through web‑accessible functions, any visitor can potentially retrieve confidential content, resulting in a breach of data confidentiality.

WordPress sites utilizing RebelCode Spotlight Social Media Feeds plugin version 1.7.1 or earlier are affected. All earlier releases of the plugin share the same exposure.

The CVSS score of 5.3 denotes a moderate threat, while the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness via the website’s public interface, typically by sending crafted requests to the plugin’s endpoints to trigger the disclosure of sensitive data.