The vendor WPBean’s Our Team Members plugin contains a vulnerability that allows an attacker to read sensitive system information that should be hidden from unauthorized users. The flaw is classified as a Sensitive Data Exposure (CWE‑497) and can lead to compromise of confidential information if the data is not properly protected. The impact is primarily on confidentiality, with no known impact on integrity or availability.

The affected product is the WordPress plugin Our Team Members by WPBean. Versions up to and including 2.2 are vulnerable. Any site that has not upgraded beyond 2.2 and is running this plugin is potentially exposed.

The CVSS base score for this vulnerability is 4.3, indicating moderate risk, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. While the description does not specify an exact attack vector, the most plausible scenario involves sending a request to a plugin–specific endpoint that reveals internal server details. Since the plugin runs within a WordPress installation, remote unauthenticated users may be able to trigger the exposed data without additional privileges.