The CVE refers to a flaw in the Hash Elements WordPress plugin that permits an unauthorized party to retrieve embedded sensitive data. The vulnerability is classified as CWE‑497 and can lead to exposure of confidential information when the plugin processes requests without proper access control. The reported CVSS score of 4.3 indicates a moderate risk for confidentiality impact, but the flaw does not grant code execution or denial of service.

Affected products are the HashThemes Hash Elements plugin for WordPress, any installation using version 1.5.4 or earlier. The vendor has identified the flaw in all releases from the earliest available version up through 1.5.4.

The fact that the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog suggests that there is currently no widespread or actively exploited instance of this flaw. The likely attack vector is via an exposed plugin endpoint or function that returns sensitive data to any user with access to the site’s frontend or backend. An attacker would need to discover the relevant URI and trigger the plugin’s data retrieval routine, which can then leak the embedded secrets. Given the moderate CVSS score, exploitation would primarily harm confidentiality without affecting availability or integrity.