The vulnerability resides in the WordPress plugin nicashmu Post Video Players and permits an unauthorized entity to read sensitive system information embedded in video playlists. It is classified as a conditional exposure of sensitive data (CWE-497). The potential impact is restricted to confidentiality—an attacker can retrieve private data but cannot modify or delete it or execute code. The vulnerability is present in all plugin releases up to and including 1.163 but not beyond.

All installations of the nicashmu Post Video Players plugin with versions from the first release (n/a) through version 1.163 are affected. The plugin is widely used in WordPress sites that host video playlists and galleries.

The CVSS vector indicates a medium severity score of 4.3, which reflects a limited impact on confidentiality. EPSS indicates a very low exploitation probability (<1%). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation. The attack vector is likely local to the WordPress environment; a malicious actor with access to the site’s administrative interface or the ability to inject parameters into the plugin could trigger the data disclosure.