An unauthenticated vulnerability in the WordPress Mailjet Email Marketing plugin allows attackers to read sensitive data from the site. Versions up to 6.2.3 are affected. The flaw permits the disclosure of confidential information that may include user contact details, marketing content, or configuration settings. The weakness is classified as CWE‑201, which focuses on sensitive data exposure, and it does not necessarily provide code execution or elevated privileges.

Systems impacted WordPress sites that have installed the Mailjet Email Marketing plugin version 6.2.3 or earlier. The affected component is the plugin itself, and any site hosting this plugin is potentially vulnerable. The vulnerability description does not specify any additional libraries or optional components.

With a CVSS score of 5.3, the issue is considered moderate. The EPSS score is 0.00251, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating that there has been no confirmed exploitation to date. Because the flaw is unauthenticated, it is inferred that a likely attack vector is remote exploitation via the WordPress site’s public URLs. While the impact is limited to data disclosure, the lack of authentication makes the attack path straightforward, and sites storing or displaying sensitive information are at risk.