Jetpack Feedback Exporter for WordPress allows an unauthenticated user to retrieve embedded sensitive system information through the plugin’s export functionality. This flaw enables attackers to expose protected data to an external control sphere, compromising the confidentiality of site contents and potentially exposing credentials, configuration files, or other sensitive material. The weakness is classified as CWE‑497, a failure to control the exposure of confidential data to an unauthorized party.

The vulnerability impacts the WordPress plugin Jetpack Feedback Exporter in all releases from the earliest available version up to and including version 1.23, shipped by J. Tyler Wiest. Sites that have installed any of these affected plugin versions are at risk.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1 % suggests that, as of now, the likelihood of real‑world exploitation is low but not zero. The vulnerability is not listed in the CISA KEV catalog, and no vendor‑issued workaround is available at present. The likely attack vector is a remote HTTP request to the site’s WordPress installation that invokes the plugin’s export endpoint; the flaw appears to be exploitable without authentication, meaning any user who can reach the HTTP endpoint can potentially retrieve the sensitive data.