Groundhogg versions up to and including 4.8.3 allow an unauthenticated attacker to read sensitive configuration or data that should be hidden. The flaw is a classic instance of CWE-201, where the software fails to protect confidential information from inadvertent disclosure. If exploited, the attacker could gain knowledge of credentials, customer data, or internal system details, leading to potential credential theft or further lateral movement within the site.

The vulnerability impacts the WordPress Groundhogg plugin manufactured by Adrian Tobey. All installations running Groundhogg 4.8.3 or earlier are affected. The vendor recommends upgrading to 4.9 or later.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of 0.00303 indicates a very low likelihood of exploitation. The vulnerability is listed neither in KEV nor any other high-profile exploitation database, suggesting that public exploitation is not confirmed. Based on the description, it is inferred that the attack vector is unauthenticated, meaning a remote attacker could trigger the disclosure without needing to log in. Attacks would likely involve invoking a public endpoint that returns the sensitive data or performing a simple file read via the plugin API.