The vulnerability allows an unauthorized party to retrieve embedded sensitive data from the WordPress Poptics plugin. Classified as CWE-497, it is a classic Sensitive Data Exposure flaw, enabling the disclosure of information that should be restricted to authorized users.

Aethonic Poptics plugin for WordPress, versions from the earliest available build up to and including 1.0.20, are affected. No other vendors or products are listed in the CNA data.

The EPSS score of less than 1% indicates that active exploitation is unlikely, and the flaw is not listed in the CISA KEV catalog, so no known active exploits exist. The CVSS score of 4.3 denotes a moderate severity, reflecting a measurable risk to confidentiality. Likely, an attacker could exploit the flaw remotely via an unauthenticated web request to the plugin’s exposed interfaces (inferred).