The vulnerability in the Site Info plugin, versions 1.1 and earlier, allows an attacker to retrieve embedded sensitive system data that should be confined to the site’s internal control sphere. Because the plugin discloses this information without proper authorization checks, the key weakness is a Sensitive Data Exposure flaw (CWE‑497). The CVSS score of 2.7 indicates a low overall severity, but the disclosure still poses a confidentiality risk if the data includes credentials, configuration secrets, or other sensitive details.

Affected systems are WordPress sites that have the Rami Yushuvaev Site Info plugin installed at versions 1.1 or older. This includes any public or private WordPress installation that has not updated past the 1.1 release. No earlier product or vendor versions are listed, so only the specified plugin and versions are impacted.

The risk is low to moderate because the EPSS score is below 1%, indicating a very small chance that the vulnerability is actively exploited. The likely attack vector is leveraging the plugin’s public interface without requiring authentication, allowing an attacker to trigger the data retrieval functionality if the widget is publicly exposed. The vulnerability is not currently listed in CISA’s KEV catalog. Although exploitation is unlikely, any exposed data could be used for further reconnaissance or credential stuffing against the site.