The QuickCal plugin as delivered through version 1.0.15 and earlier contains an issue that allows an attacker to retrieve embedded sensitive system data. This flaw stems from an improper management of sensitive information as identified by CWE‑497 and can lead to the unauthorized disclosure of confidential details. The CVSS score of 4.3 reflects a moderate severity, indicating that once exploited a moderate level of damage is expected but not catastrophic.

The vulnerability affects Themovation’s QuickCal Appointment Booking Calendar for WordPress plugin on all WordPress installations that use any version up to and including 1.0.15. No specific WordPress core version is mentioned, so any site with the vulnerable plugin is potentially impacted.

Based on the description, it is inferred that the attacker requires access to the WordPress control sphere, likely through the QuickCal plugin interface or by compromising administrative credentials, to read the exposed sensitive data. The EPSS score below 1 % indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits at present. Nonetheless the flaw allows an attacker with that access to read sensitive data exposed by the plugin. The moderate CVSS score signals that exploitation could perform a data breach with limited but real impact.