The vulnerability in the Nexter Blocks plugin allows the retrieval of embedded sensitive data present in the system. This leads to a sensitive data exposure that could compromise confidentiality. The weakness is a form of insecure data exposure due to improper handling of sensitive information (CWE-497).

The issue affects the POSIMYTH Nexter Blocks plugin in all supported versions up to and including 4.6.3. Any WordPress site that has installed the plugin prior to version 4.6.4 may be exposed.

The CVSS score of 7.5 indicates a moderate to high impact, yet the EPSS is reported as less than 1%, indicating that real‑world exploitation is presently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers are most likely to exploit this flaw via the web interface by triggering plugin functionalities that expose hidden data. Because the flaw involves accessing data that is not meant for public consumption, an attacker who can execute the vulnerable code path could read sensitive configuration or user information. No prerequisite wide spread vulnerability is required, only a site running the affected plugin.