Use of hard‑coded credentials in Essekia Helpie FAQ allows attackers to retrieve embedded sensitive data. The flaw originates because the plugin stores credentials directly in its code, which authorizes unauthorized reads of protected data. Because the vulnerability permits exposure of confidential content, compromised sites risk leaking user or administrator information, jeopardizing confidentiality and potentially violating privacy rules.

The vulnerability affects the Essekia Helpie FAQ WordPress plugin for all releases up to and including 1.45. Any WordPress installation that has the plugin within this version range is at risk. Versions newer than 1.45 are not impacted.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote exploitation of the plugin’s exposed endpoints that use the hard‑coded credentials via crafted HTTP requests. Successful exploitation would expose sensitive data stored or managed by the plugin. The moderate CVSS and low EPSS imply a lower threat urgency, but the confidentiality risk warrants prompt attention.