The WordPress Wishlist plugin from redqteam allows an unauthorized user to retrieve embedded sensitive system data. Because the plugin does not enforce proper privilege checks when exposing its internal data, an attacker can obtain credentials, configuration details, or other confidential information. The flaw is classified as CWE‑497, which denotes exposure of sensitive system information to an unauthorized control sphere. By reading this exposed data an adversary could potentially advance further attacks against the WordPress site or its underlying server.

Any WordPress installation that has the redqteam Wishlist plugin installed in version 2.1.0 or earlier is affected. The vulnerability applies universally to all instances of the plugin, regardless of site size, theme, or WordPress version.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is less than 1%, showing that, at the time of analysis, the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, so there is currently no evidence of active exploitation. Based on the description, the attack vector is likely web‑based, requiring the attacker to send crafted requests to the plugin’s front‑end or exposed API endpoints that return internal data. No public exploit was identified in the available references.