The vulnerability in the Bowo System Dashboard WordPress plugin allows an attacker with an incorrectly configured access control to obtain sensitive system information. This is classified as a Sensitive Data Exposure flaw, corresponding to CWE‑497, and could lead to disclosure of confidential environment details to an unauthorized control sphere.

All installations of Bowo System Dashboard plugin up to and including version 2.8.18 are affected. The issue applies from the earliest available version through 2.8.18, with no later releases listed as vulnerable.

The CVSS base score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an entity to gain access to the WordPress control panel and leverage incorrectly set permissions to read system information from the plugin’s interface. No public demonstration of a working exploit exists, but the potential for data leakage exists if improper ACLs remain in place.