The vulnerability is caused by hard‑coded credentials embedded in the Estonian Shipping Methods for WooCommerce plugin. An attacker who can obtain these credentials can retrieve sensitive data stored by the plugin, resulting in a confidentiality breach. This weakness is classified as CWE‑798, hard‑coded credentials. The impact is the exposure of data that should be protected, without affecting system integrity or availability.

Risto Niinemets Estonian Shipping Methods for WooCommerce plugin, versions 1.7.2 and earlier.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is less than 1%, suggesting a very low exploitation probability for the current market. The vulnerability is not listed in CISA KEV. Exploitation requires knowledge of the hard‑coded credentials; an attacker could trigger the data retrieval by sending crafted requests to the plugin’s endpoints or via the admin interface. The likely attack vector is an authenticated or unauthenticated request to the plugin once the credentials are known.