The WordPress Social Pug plugin contains a flaw that allows an unauthorized actor to acquire embedded sensitive system information. The plugin’s handling of certain requests inadvertently reveals details that should be protected, effectively exposing confidential data to an external control sphere. Because the vulnerability is tied to plugin logic rather than a lower-level system deficiency, the attacker does not need to compromise the underlying server‑operating system; gaining access to the plugin’s interfaces is sufficient to exploit this weakness. This flaw is classified as CWE‑497.

All installations of NerdPress Hubbub Lite Social Pug plugin from the earliest version through 1.35.2 are affected. Any WordPress site that has deployed the plugin in this version range is at risk.

The CVSS score of 4.3 places the issue in the moderate range, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves HTTP requests to the plugin’s endpoint or administrative interface; an attacker with web access to the site can trigger the data exposure, although additional credentials may be required depending on site configuration.