This vulnerability allows an attacker to expose sensitive system information that is embedded within the Shahjada Download Manager plugin. The flaw is classified under CWE‑497, indicating that confidential data can be read by an unauthorized control sphere. An attacker who can trigger the vulnerability would gain access to data that normally should remain hidden, potentially compromising user privacy and internal system details. The impact is limited to data disclosure, without direct code execution or denial of service.

Affected systems include the Shahjada Download Manager plugin for WordPress. Versions from the earliest release up to and including 3.3.25 are susceptible. No other plugins or system components are listed as vulnerable.

The CVSS score of 5.3 indicates a moderate level of risk, and the EPSS score of less than 1% shows a low but non‑zero likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is through privileged or authenticated user access within a WordPress site, enabling the attacker to retrieve embedded data via the plugin’s exposed functionality. No additional prerequisites such as remote code execution are required, but the attacker would need to be able to execute or call plugin features within the web application environment.