The vulnerability allows an attacker to retrieve sensitive data embedded within the User Spam Remover plugin. The description does not specify the types of data exposed, only that sensitive information can be retrieved without authorization. This is a failure to properly protect sensitive information and is designated as CWE-497. Loss of confidentiality may result, but the exact impact depends on what data the plugin stores.

The User Spam Remover plugin distributed by Joel is affected in all releases from n/a through version 1.1. WordPress sites that have installed these versions of the plugin are at risk of exposing sensitive data.

Based on the description stating that the issue allows unauthorized retrieval of embedded data, the likely attack vector involves accessing the plugin’s data endpoints or its administrative interface, which may be reachable if authentication checks are inadequate. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not included in CISA’s KEV catalog.