The Restaurant Menu by MotoPress WordPress plugin contains a vulnerability that allows an unauthorized control sphere to retrieve embedded sensitive data. The flaw is present in all releases through 2.4.7 and is classified as CWE‑497. An attacker could cause a loss of confidentiality by accessing information that is not intended for public consumption, potentially revealing system configuration or other sensitive data.

The affected product is the WordPress plugin Restaurant Menu by MotoPress from jetmonsters, version 2.4.7 and earlier. Systems running the plugin in any environment exposed to the web are at risk.

The CVSS base score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests exploitation probability is low. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves interacting with the plugin’s public interfaces, possibly through authenticated or unauthenticated requests to plugin endpoints. Because the vulnerability enables arbitrary data retrieval, a malicious actor could exfiltrate information without additional privileges. The mitigations recommend disabling exposed interfaces or updating to a patched version.