The vulnerability resides in the mediavine-control-panel plugin for WordPress and allows an unauthorized control sphere to retrieve embedded sensitive system information. This results in the disclosure of confidential data that the plugin stores as configuration values. The weakness is categorized as CWE‑497, which is a confidentiality compromise through improper disclosure of sensitive information.

Affected systems are WordPress sites that have the Mediavine Control Panel plugin installed, specifically versions up to and including 2.10.6. All earlier releases are also impacted because the issue exists from n/a through 2.10.6. Site administrators should review the plugin version used on their installations.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% reflects a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the vulnerability can be exploited by sending requests to the plugin’s data retrieval functionality, and the attacker needs either unauthenticated or potentially authenticated access to the plugin’s control page. Because the sensitive data is exposed without proper access checks, the risk persists as long as the plugin remains on a WordPress installation.