The WP SMS plugin versions up to 7.2.1 contain a flaw that allows unauthorized disclosure of subscriber data, classified as a CWE-288 vulnerability. An attacker can obtain personal information stored for each subscriber, potentially compromising privacy and violating data protection requirements. The impact is a loss of confidentiality of subscriber records that could be used for more damaging attacks if combined with other exploits.

Any WordPress site using the WP SMS plugin from VeronaLabs with a version of 7.2.1 or older. The vulnerability affects the plugin handling subscriber data in the WordPress administration environment.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. It is not listed in CISA’s KEV catalog. The attack vector is inferred to require access to the plugin’s backend or to exploit a publicly exposed endpoint that returns subscriber data. An authenticated administrator user or one with sufficient privileges to query the plugin endpoints may be able to trigger the disclosure.