The vulnerability in the Getwid WordPress plugin allows an attacker to retrieve embedded sensitive data that should not be exposed. This results in the leakage of confidential information, compromising data confidentiality. The weakness is a classic example of information exposure (CWE‑201).

Vendors and products affected by this flaw include the jetmonsters:Getwid WordPress plugin. All installations of Getwid from the product’s inception up to version 2.1.2 are vulnerable. Higher‑than 2.1.2 versions are not affected.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is remote, via a web request that triggers the plugin’s data output functionality, but the description does not explicitly state how the data is retrieved, so the precise exploitation path is inferred rather than confirmed.