A flaw in Metagauss EventPrime event scheduling plugin versions up to 4.2.8.3 allows an attacker to retrieve embedded sensitive system information, effectively leaking confidential data. This weakness corresponds to CWE‑497 and permits unauthorized disclosure of data that should be protected from the control sphere. The vendor documentation indicates that the issue stems from an exposure of sensitive system information during plugin operation, but the exact mechanism is not detailed in the public description.

The vulnerability impacts the EventPrime plugin for WordPress developed by Metagauss. All releases from the first public version up to and including 4.2.8.3 are vulnerable. Users running any of these versions should verify the installed plugin version and consider upgrading if still in use.

The CVSS score of 5.3 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates a very low current likelihood of exploitation. It is not listed in the CISA KEV catalog, meaning no publicly known exploits are documented. The attack vector is not described explicitly; however, based on the nature of the vulnerability it is inferred that the flaw could be triggered by accessing plugin‑related endpoints that expose internal data, so it may be exploitable remotely through the WordPress front‑end or back‑end depending on configuration.