The vulnerability in the Audio Editor & Recorder WordPress plugin allows an attacker to retrieve embedded sensitive system information from the host. This flaw exposes data that should be protected, giving an adversary potential access to confidential information stored or processed by the plugin. The disclosed weakness is classified as CWE‑497 and results in a moderate confidentiality impact as reflected by a CVSS score of 5.3.

The flaw affects all releases of Roland Beaussant’s Audio Editor & Recorder plugin with versions up to and including 2.2.3, including any WordPress sites that have installed the plugin during its n/a‑through‑2.2.3 release range.

The CVSS score of 5.3 indicates moderate severity; however, the EPSS score of less than 1 % signals an extremely low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog, and the public description does not specify a remote attack vector, implying that exploitation likely requires local access or an already‑compromised WordPress environment. Given the modest risk and limited exploitation probability, the overall threat remains moderate, but organizations should not ignore it.