The Image Cleanup WordPress plugin contains a flaw that lets an attacker retrieve sensitive system information embedded in the plugin’s files, allowing the exposure of configuration details, server metadata, or other confidential data to an unauthorized or low‑privilege user. This leads to a compromise of confidentiality, as private data could be disclosed or used for further attacks. The weakness is categorized as CWE‑497, which relates to mishandling of sensitive data.

The vulnerability affects the Image Cleanup plugin developed by opicron, which is available to WordPress users. All installations of the plugin with a version <= 1.9.2 are impacted; no specific sub‑versions are provided, so any release up to and including 1.9.2 is considered vulnerable.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is reported as < 1%, showing a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred as an unprotected plugin endpoint that can be accessed by any user, allowing the retrieval of embedded sensitive data without authentication or with minimal privileges.