A vulnerability in the WPDeveloper BetterDocs WordPress plugin allows the retrieval of embedded sensitive data. The flaw can expose confidential system information to unauthorized users, resulting in a breach of confidentiality. This weakness is classified as CWE-497 – Sensitive Information Exposure. While the description does not specify an explicit exploitation method, it is inferred that an attacker could access the exposed data through the plugin’s web interface or any exposed API endpoints that deliver the embedded content.

The vulnerability affects the BetterDocs plugin provided by WPDeveloper for WordPress platforms. All releases up to and including version 4.3.10 are impacted. No other product or vendor is listed as affected.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting no known active exploits at this time. The likely attack vector is through remote access to the WordPress site, such as browsing a page that renders BetterDocs content or invoking exposed endpoints, enabling data extraction. Given the moderate score and unavailable exploitation data, the risk is considered medium, but any site that hosts the vulnerable plugin could potentially expose sensitive information to anyone with access to the site.