The Guest posting / Frontend Posting / Front Editor WordPress plugin, in releases before 5.0.6, allows an external user to supply a URL parameter that triggers regeneration of a .json file from demo data. When an administrator has altered the demo form and enabled admin notifications, the resulting JSON contains all form input and configuration, including the administrator’s email address. This is a classic disclosure of confidential data with the weakness described as CWE‑200. No authentication is required for the attacker to obtain the data.

Any WordPress installation that has the Guest posting / Frontend Posting / Front Editor plugin installed in a version earlier than 5.0.6 is vulnerable. The CVE notes that the issue exists in all releases up to and including 5.0.5; no explicit patch version is listed in the provided data.

The CVSS base score of 5.9 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of active exploitation in the wild. The vulnerability is not present in the CISA KEV catalog, implying no known widespread exploitation. An attacker only needs to craft a URL to the plugin endpoint; no credentials or privileged access are required, making exploitation straightforward from any network that can reach the site’s public interface.