The following weakness allows an unauthenticated attacker to retrieve sensitive information that is embedded in the WordPress Follow My Blog Post plugin. Because the plugin exposes this data without proper access controls, an attacker could gain confidential knowledge about the site environment, configuration, or user data, thereby compromising confidentiality. This vulnerability is classified as CWE‑497 – Disclosure of Sensitive Information.

The vulnerability affects the WordPress plugin Follow My Blog Post from vendor wpweb. All installed instances with version 2.3.9 or earlier are affected. No specific patch version is listed, so upgrading beyond 2.3.9 is required to remediate.

The CVSS score of 7.5 indicates high severity. The EPSS score is less than 1 %, suggesting that exploitation is currently unlikely but still possible in a targeted context. The vulnerability is not included in CISA’s KEV catalog, so no widespread exploitation has been reported. The attack vector is inferred to be a remote web request against the plugin’s exposed endpoints; the attacker does not need privileged access to the server or additional authentication to extract the data.