A vulnerability in CoSchedule plugin for WordPress allows sensitive information to be exposed to an unauthorized control sphere. The flaw enables retrieval of embedded sensitive data and is classified under CWE-497, representing a failure to restrict access to authenticated users. An attacker who can exploit the exposure may learn confidential system details, potentially aiding further attacks.

This affects all versions of the CoSchedule plugin up to and including 3.3.11 on WordPress installations. The vulnerability applies to every instance of CoSchedule from the earliest release through version 3.3.11.

The CVSS score of 5.3 indicates moderate overall risk, and the EPSS score of less than 1% suggests that exploitation is unlikely but possible. The vulnerability is not listed in CISA's KEV catalog. Because the description does not specify the exact attack vector, it is inferred that the data retrieval may be possible from the plugin's administrative interface or via requests that an unauthenticated or authenticated user with plugin access can trigger.