A flaw in the IDonatePro plugin allows an attacker to retrieve embedded sensitive system information. The vulnerability is a classic information disclosure that can expose data the plugin has stored or generated while operating under WordPress, potentially giving an unauthorized user insight into the site’s internal configuration or user data. This type of weakness is identified as a CWE-497 attack, reflecting the exposure of data that should remain confidential.

The vulnerability affects the ThemeAtelier IDonatePro WordPress plugin on all installations running version 2.1.9 or earlier. The issue spans the open-source product bundle and is present across the WordPress ecosystem where the plugin is deployed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, further indicating a relatively low threat terrain. The likely attack vector is inferred to be a remote request to the plugin’s front‑end or internal API, given its nature as a WordPress plugin. No exploit code is publicly disclosed, but the impact could be significant if sensitive data were compromised.