The Greenshift – animation and page builder blocks plugin for WordPress holds a vulnerability that allows any unauthenticated user to read a publicly accessible settings backup file. This file contains full copies of all configuration settings, including API keys for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile. An attacker who can download this file can therefore steal valuable credentials and potentially compromise user accounts or services that rely on these APIs.

WordPress sites using the Greenshift plugin prior to or including version 12.8.3 are affected. The issue is specific to this plugin and does not extend to other WordPress components or external applications.

The vulnerability has a CVSS score of 5.3, indicating a moderate impact. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation at present, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw by simply accessing the backup file over the network; authentication is not required.