WordPress WP FullCalendar plugin versions 1.6 and earlier allow exposed system information to be retrieved by an unauthorized control sphere. This flaw arises from a failure to protect sensitive data within the plugin and is classified under CWE‑497, indicating insufficient handling of internal system resources. An attacker who can influence the plugin's behavior could use the exposed data to gain insight into the underlying WordPress environment or identify potential further attack vectors, thereby compromising confidentiality.

Affected installations are sites running the WP FullCalendar plugin developed by Marcus (aka @msykes). All plugin versions from the first release up to and including 1.6 are vulnerable, regardless of WordPress core version or other plugin configuration.

The CVSS v3.1 score of 7.5 indicates a high severity, and the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not flagged in the CISA KEV catalog. Attackers would likely need to interact with the plugin through a legitimate WordPress session or exploit a broader administrative access to read the exposed data; the exact vector is not detailed, but it appears to require at least some level of authenticated interaction, implying that privileged users may be the primary targets.