The WP Popup Builder plugin for WordPress suffers from a flaw that allows an unauthenticated user to retrieve embedded sensitive data from the system. This vulnerability can lead to confidentiality loss if attackers read configuration or credential information stored by the plugin. The weakness is classified as CWE-497, reflecting its nature as a scenario where sensitive data is available outside a secure boundary.

The problem exists in the WP Popup Builder plugin distributed by ThemeHunk, affecting all releases from the earliest version through version 1.3.8. Users running any of those versions on a WordPress site are potentially exposed.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that the likelihood of exploitation is currently very low. The issue is not listed in the CISA KEV catalog, limiting known exploit activity. No explicit attack vector is disclosed, so it is inferred that the attacker would need to be able to invoke plugin logic in the context of a WordPress installation, likely through a published URL or plugin interface. Given the low EPSS, the risk for a malicious actor remains relatively modest, but the impact on confidential data warrants remediation.