The vulnerability occurs in the WordPress m1.DownloadList plugin when an attacker can retrieve embedded sensitive data that may include system credentials or other private information. The weakness, classified as CWE‑497, permits the exposed data to be accessed by unauthenticated users, creating a sensitive data exposure issue.

WordPress sites that have the m1.DownloadList plugin installed on versions 0.24 or earlier from the developer maennchen1.de. The plugin’s files and endpoints are publicly reachable for anyone who can trigger the plugin’s pages, providing direct access to the sensitive information without authentication checks.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is through the plugin’s publicly exposed pages or URLs, meaning any visitor to the site could trigger the data extraction without elevated privileges.