The vulnerability in the POSIMYTH Nexter Blocks plugin enables an attacker to retrieve embedded sensitive system information, exposing data to an unauthorized control sphere. This flaw hampers the confidentiality of the WordPress environment and can potentially allow an attacker to access configuration data, user credentials, or other privileged information. The weakness aligns with CWE-497, indicating a failure to properly restrict access to sensitive resources.

Affected systems are installations of the POSIMYTH Nexter Blocks plugin, commonly known as the +Addons for Block Editor, on WordPress sites. Versions from the earliest release through 4.7.0 are vulnerable, with no specific sub‑version constraints beyond the stated upper limit.

The CVSS score of 5.3 categorizes this issue as moderate in severity, while an EPSS score below 1 % suggests a low likelihood of quick exploitation. The plugin's web‑based nature indicates that the attack vector is likely remote, possibly via crafted HTTP requests to the plugin’s API or admin interface, although this is inferred from the description and not explicitly stated. The vulnerability is not listed in the CISA KEV catalog, underscoring that it is not a widely exploited flaw at present.