The vulnerability allows an attacker to retrieve embedded sensitive data from a WordPress site through the Virusdie plugin version 1.1.6 or older. The flaw arises because the plugin exposes system information without proper access controls, leading to insecure disclosure of sensitive information. This is classified as CWE‑497.

The issue affects any WordPress installation that has the Virusdie plugin version 1.1.6 or earlier. The plugin is distributed through the WordPress plugin repository under the vendor Virusdie.

The CVSS score of 4.3 indicates a medium severity risk. The EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description: an attacker would need to gain administrative or privileged access to the site, or exploit an exposed plugin endpoint to retrieve data. The plugin’s lack of proper access controls suggests that unauthorized users could reach sensitive data if they can reach the plugin’s functions. No public exploits have been reported yet.