The WP ERP plugin from weDevs up to and including version 1.16.6 contains a flaw that allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as CWE‑497, indicating improper control of opened resources. An attacker who can exploit this flaw would gain access to confidential system information, potentially allowing further malicious activity such as credential theft or configuration disclosure.

Systems running WordPress with the weDevs WP ERP plugin at version 1.16.6 or earlier are affected. The vulnerability spans all deployments of this plugin that have not been updated to a newer release.

With a CVSS score of 6.5, the issue represents a moderate severity risk and may be exploited with moderate effort. The EPSS score of less than 1% suggests exploitation has not yet been observed or is unlikely, and the vulnerability is not in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, via the plugin’s web interface, allowing an unauthenticated or minimally privileged attacker to trigger the data exposure.