An issue in the Softaculous PageLayer plugin up to version 2.0.8 allows an unauthenticated user to retrieve sensitive system information embedded in the plugin’s configuration. The vulnerability could expose internal data such as database credentials or API keys, potentially undermining the confidentiality of the site’s environment. It is categorized as CWE‑497. The impact is the unauthorized disclosure of confidential system data.

The affected component is the Softaculous PageLayer plugin for WordPress, with all releases from the earliest available through version 2.0.8. Site owners who have installed or enabled this plugin during that time window are at risk.

The CVSS score of 4.3 classifies the vulnerability as moderate. The EPSS score is below 1%, indicating that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the WordPress site’s web interface; an attacker could access exposed plugin configuration through a publicly reachable URL or by exploiting the plugin’s administration page. Incidents would primarily affect confidentiality rather than integrity or availability.