The WordPress Instantio plugin contains a flaw that permits the exposure of sensitive system information to an unauthorized control sphere, enabling an attacker to retrieve embedded sensitive data and potentially compromise private data that should be protected. This weakness is typified by CWE-497, indicating that sensitive information is exposed due to inadequate access controls.

All installations of the Themefic Instantio WordPress plugin from its earliest releases through version 3.3.30 are impacted; site administrators using this plugin in any supported WordPress environment should verify the installed version and determine whether an upgrade is possible.

The CVSS score of 5.3 places the vulnerability in the moderate severity range, while an EPSS score of less than 1% indicates a low likelihood of exploitation across the broader ecosystem. The plugin has not been listed in CISA's KEV catalog, suggesting no widespread enterprise exploitation has been reported yet. Based on the description, the likely attack vector is unauthenticated HTTP requests that exploit the plugin’s embedded data exposure functionality—though specific trigger conditions are not detailed in the public advisory, so the full exploitation path remains inferred.