The Edwiser Bridge plugin versions up to 4.3.4 contain an unauthenticated sensitive data exposure flaw that allows attackers to read confidential information. This vulnerability is classified as Information Exposure (CWE‑201) because it permits disclosure of data that should be restricted. Without authentication, an adversary can gain access to sensitive data stored or handled by the plugin, potentially leaking user or site information.

The affected product is the WisdmLabs Edwiser Bridge WordPress plugin with versions 4.3.4 or earlier. Any WordPress installation that has this plugin installed and not upgraded beyond 4.3.4 is vulnerable.

The vulnerability has a CVSS score of 7.2, indicating a high severity. EPSS score of 0.00336 suggests a low but non-zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Inferred from the description, the attack vector is unauthenticated; an adversary can simply access the exposed data without needing credentials. Attackers could compromise confidentiality by reading the sensitive information, which could lead to broader account compromise or data leakage.