The flaw allows the plugin to expose sensitive information that is embedded in the data it serves to users. This information can be retrieved by interacting with the plugin’s output, potentially exposing internal configuration values or other confidential data. The weakness corresponds to CWE‑201, an information‑exposure flaw affecting confidentiality.

The vulnerability affects the stmcan RT‑Theme 18 | Extensions WordPress plugin versions from the earliest available versions through ≤ 2.5. Any WordPress site that has this plugin installed and activated during that version range is potentially impacted.

No publicly available CVSS or EPSS score is provided for this issue, and it is not listed in the CISA KEV catalog, so the precise severity and exploitation likelihood are unclear. Based on the description, it is inferred that an attacker could access the plugin’s data‑retrieval endpoints via the web interface, making remote exploitation possible. However, the actual attack conditions and required privileges are not detailed in the available data.