The flaw in the Foxit eSign for WordPress plugin allows an attacker to retrieve embedded sensitive data that should be protected within the application. This weakness is classified as CWE‑497, indicating that sensitive information is improperly exposed. If exploited, an attacker could gain confidential details stored by the plugin, potentially hacking into user accounts or leaking proprietary data.

The vulnerability affects the esigngenie Foxit eSign for WordPress plugin on WordPress installations. All releases of the plugin from the unknown initial version through version 2.0.3 are impacted. Users who have not yet upgraded beyond 2.0.3 should review their deployment of this plugin.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score of <1 % indicates a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. While the description does not specify the exact attack surface, the logical attack vector is likely through an authenticated or publicly exposed feature of the plugin that returns data. An attacker with access to the WordPress instance could invoke that feature to export or view sensitive data embedded by the plugin.