The vulnerability is a missing authorization flaw that permits unauthenticated users to retrieve embedded sensitive data from the Modula Image Gallery plugin. This flaw allows an attacker to read information that should be restricted to authorized users, potentially exposing usernames, email addresses, or other private content. The weakness corresponds to CWE-862, which highlights lack of access control. The impact is limited to confidentiality leakage rather than code execution or denial of service.

The issue impacts the WordPress Modula Image Gallery plugin, version 3.0.11 and earlier, distributed by WP Chill under the name Modula Image Gallery. Any WordPress installation that has this plugin installed at or below version 3.0.11 is vulnerable. No specific operating system or WordPress version constraints beyond the plugin's version.

With a CVSS score of 5.3, the vulnerability is considered medium severity. The EPSS score is not available, so the current exploitation probability is uncertain, but the lack of an access control check suggests that an attacker could exploit the flaw simply by accessing the vulnerable endpoint or API. Since the vulnerability is listed as not in KEV, there are no confirmed widespread attacks, but the potential for sensitive data leakage warrants prompt attention. The attack vector is likely local to the web interface of the WordPress site, and the attacker needs no specific privileges to gain the data.