Sensitive data is written into log files by the AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin, allowing an attacker to retrieve embedded sensitive information. The flaw arises from the plugin’s insufficient protection of log contents, which can expose credentials or other confidential data to unauthorized readers. An attacker who can read the logs would be able to obtain this exposed information.

The vulnerability impacts all version releases of the plugin up through and including 1.3. The plugin is provided by Smackcoders Inc. and is known as the AIO Performance Profiler, Monitor, Optimize, Compress & Debug, also referenced as all‑one-performance‑accelerator. WordPress sites that have any of these vulnerable versions are within scope.

The CVSS score of 5.3 classifies the weakness as a moderate severity issue. The EPSS score is under 1 % and the vulnerability is not listed in CISA KEV, indicating a low current probability of exploitation. Nonetheless, if an attacker manages to access the WordPress administrative interface or an account that can read log files, they can retrieve the sensitive data that the plugin has logged. This inferred attack vector relies on privileged access to logs rather than on remote code execution or denial of service.