The vulnerability allows an unauthorized entity to retrieve embedded sensitive data from the WordPress Mail Mint plugin. This data could include configuration details, API keys, or other identifiers that could be used to compromise the hosting environment. The weakness is identified as CWE‑497, indicating that sensitive system information is exposed through inadequate access controls or improper design of data handling mechanisms. This exposure threatens confidentiality of business and user data but does not result in code execution or direct denial of service.

Affected systems are installations of the WordPress Mail Mint plugin developed by WPFunnels Team. All versions from the earliest release through 1.19.5 are vulnerable. No other products are listed as impacted.

With a CVSS score of 4.3, the vulnerability is classified as medium severity and is not listed in CISA KEV. Based on the description, the likely attack vector is via the web application once the plugin is installed; an attacker would need an authenticated session or site access to read the exposed data, implying that compromised site credentials or an administrative role could be prerequisites for exploitation.