The vulnerability allows unauthenticated exposure of sensitive data within the EmbedPress plugin for WordPress versions 4.5.2 and earlier, potentially enabling attackers to retrieve confidential information without needing credentials. The flaw is classified as CWE‑639, indicating missing or misapplied access control. Because the plugin does not enforce authentication, the data exposed could include user data, configuration settings, or other private content managed by the plugin.

Affected systems include websites that have installed WPDeveloper’s EmbedPress plugin through version 4.5.2 or any earlier release. The fix is the official update to version 4.5.3 or later, which removes the unauthenticated data exposure. Sites using any version preceding 4.5.3 should apply the patch immediately or remove the plugin if it is not required.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of < 1 % suggests a low likelihood of exploitation in the wild at present. The vulnerability is listed as not in the CISA KEV catalog, meaning no known public exploits have been documented. Based on the description it is inferred that the attack vector is remote via the web interface, with no authentication required, so any Internet‑exposed server running an affected plugin version is potentially vulnerable.