The TailPress plugin for WordPress incorporates a flaw that allows it to write sensitive information—such as credentials, tokens, or personal data—to files or directories that are publicly viewable. This flaw, classified as CWE‑538, means that anyone who can access the web server can read these files, leading to direct exposure of confidential data.

Any WordPress site that has installed the TailPress plugin version 0.4.4 or earlier is affected. Those sites are at risk if the plugin’s output files are served from web‑accessible directories such as the uploads or plugin folder. Sites with newer releases are presumed unaffected because the issue does not apply to versions beyond 0.4.4.

The vulnerability scores a CVSS 5.8, indicating a moderate risk, and the EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment. It is not currently listed in the CISA KEV catalog. Attackers would likely exploit this weakness by sending crafted requests that trigger the plugin to write data to public paths or simply by browsing the web root for already‑written files. Because the data is exposed via the web server, the attack does not require privileged access, making the attack vector effectively remote, though it relies on the vulnerable plugin’s code and web server configuration.