The Seriously Simple Podcasting plugin for WordPress contains a flaw (CWE‑497) that permits retrieval of embedded sensitive data by an unauthorized user. When a request is made to the vulnerable endpoint, the plugin exposes system information that should not be publicly accessible. Although the exact method of exploitation is not detailed in the advisory, it likely occurs through a web request that the plugin does not properly validate.

This issue affects the Seriously Simple Podcasting plugin developed by Craig Hewitt. All releases from the earliest available version up through 3.13.0 are vulnerable. Users running any of these versions on a WordPress site are at risk.

The CVSS score of 5.3 indicates a medium level of severity, while the EPSS score of less than 1% suggests that exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to access the WordPress site, likely via a web request to the plugin’s exposed endpoint, to extract the sensitive data. No public exploit or additional conditions are known, but the impact could compromise confidentiality if the exposed data contains critical system information.