The vulnerability allows an attacker to retrieve embedded sensitive data from the Solid Plugins AnalyticsWP plugin, exposing system information to an unauthorized control sphere. Classified as CWE-497, this sensitive data exposure could enable malicious actors to obtain confidential configuration or environment details that may be leveraged for further attacks. The CVSS score of 5.3 indicates a moderate severity for confidentiality and integrity.

WordPress sites that use the Solid Plugins AnalyticsWP plugin are affected, specifically all releases from the earliest version through 2.1.2. Any site that has installed this plugin and has not upgraded beyond version 2.1.2 is vulnerable.

The low EPSS (< 1%) shows that exploitation is unlikely in the near term, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to access the plugin’s data endpoints or exploit a publicly exposed configuration file, which is generally achievable from the web interface once the plugin is active. The moderate CVSS score reflects the potential confidentiality impact, but the overall risk remains moderate due to the low exploitation probability.