The vulnerability in the Ninja Charts WordPress plugin allows an attacker to retrieve embedded sensitive data. The flaw permits exposure of confidential system information that should be protected from unauthorized access. This can lead to compromise of data confidentiality and may enable further attacks if the data is used to map sensitive system configurations.

This issue affects the Ninja Charts plugin developed by Mahmudul Hasan Arif. Versions from the initial release up through 3.3.5 are impacted. Users deploying any of these versions on WordPress sites are vulnerable.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or requires authenticated access to the plugin, based on the plugin's operational context. Because sensitive data is exposed, an attacker who can obtain or guess a valid authentication token could potentially exploit this flaw to collect confidential information.