The Hesabfa Accounting plugin for WordPress has a flaw that allows the plugin to write sensitive information, such as user credentials or financial details, into log files. This flaw is classified as CWE‑201 (Information Exposure). If an attacker can read these log files, they can recover the embedded sensitive data, compromising confidentiality.

WordPress installations running the Saeed Sattar Beglou Hesabfa Accounting plugin version 2.2.5 or earlier are affected. The vulnerability applies regardless of the operating system because the plugin functions within the WordPress environment.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score of less than 1% suggests that public exploitation is rare. The vulnerability does not appear in the CISA KEV catalog, indicating no known high‑profile exploitation. Exploitation would require the attacker to access the log files where the sensitive data is stored, which may be achievable if the logs are placed in a publicly reachable location or if the attacker can read the server file system. Without such access, the risk remains limited to scenarios where an attacker can reach the logs through some other misconfiguration or user privilege.