Technical impact
The Plant - Gardening & Houseplants WordPress Theme contains a vulnerability that allows an attacker to retrieve sensitive system information that should not be publicly accessible. The vulnerability manifests as an inappropriate exposure of data embedded within the theme, which could reveal configuration details, server paths, or other confidential information. This weakness falls under CWE‑497 and primarily undermines the confidentiality of the site.
Affected Systems
The vulnerability affects EngoTheme's Plant - Gardening & Houseplants WordPress Theme, from the earliest version through 1.0.0. All installations using these versions are impacted.
Risk and Exploitability
The CVSS score of 5.3 denotes moderate severity. The EPSS score of <1% indicates that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The likely attack vector is remote via the WordPress front‑end, where an attacker can access a page that renders the theme’s data. No privileged credentials are required to trigger the data leakage, making the exploitation fairly straightforward if an attacker can locate the affected endpoint.
