WP Desk ShopMagic allows sensitive information to be written into files or directories that are publicly accessible, enabling an attacker to read those files and retrieve confidential data such as payment details or credentials. The issue is classified under CWE-538, indicating a flaw in preventing sensitive data exposure.

The vulnerability affects the ShopMagic plugin for WordPress from unspecified earlier versions through 4.9.1. Any WordPress installation using WP Desk ShopMagic 4.9.1 or older is susceptible.

The CVSS score of 5.3 categorizes the flaw as moderate in severity. The EPSS score is not available, making it difficult to gauge the current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves accessing a publicly reachable file or directory that was created or modified by the plugin, which could expose the data without requiring authentication. No exploit evidence is provided, so the risk depends largely on the exposure of such files on the target site.