This vulnerability allows the retrieval of embedded sensitive system information from the Simple Ajax Chat WordPress plugin. Consequently, any unauthorized user can obtain confidential data, leading to a breach of confidentiality. The weakness, identified as CWE-497, permits exposure of sensitive data without proper access controls.

The issue affects Jeff Starr’s Simple Ajax Chat plugin for WordPress on any installation using version 20251121 or earlier. No specific WordPress core version is mentioned, so any site running any of those plugin versions is at risk.

The CVSS score of 5.3 classifies the severity as moderate, while the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface or API, where an unauthenticated or insufficiently authorized user can trigger data retrieval. No additional prerequisites are described in the advisory, so the vulnerability can be exploited as long as the vulnerable plugin is active on a publicly accessible WordPress site.