The vulnerability in WordPress Review Schema allows an attacker in an unauthorized control sphere to retrieve embedded sensitive data from the plugin. This exposure leaks confidential system information that should be protected. The weakness is classified as CWE‑497, indicating improper handling or disclosure of sensitive data.

The affected product is the RadiusTheme Review Schema plugin for WordPress. All releases from any earlier version up through 2.2.6 are impacted; no later releases are listed in the advisory.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1%, implying a low probability of exploitation at this time, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s interface, presumably requiring authenticated access to the WordPress admin area, though it could also be triggered by users who can load publicly exposed plugin endpoints. Successful exploitation would enable an attacker to read sensitive system data and could facilitate further malicious activity.