The XCloner plugin in versions 4.8.6 and earlier is vulnerable to a sensitive data exposure flaw (CWE‑201). This weakness could allow an attacker to obtain subscriber information that is intended to be protected, potentially leading to a breach of confidentiality for users whose data is managed by the plugin. The precise nature of the exposed data is not specified in the CVE description, so it is inferred that the exposed data consists of confidential subscriber information, albeit the exact fields are unspecified.

WordPress sites utilizing the XCloner backup and restore plugin of version 4.8.6 or earlier are affected. The vulnerability applies to all instances where this plugin is active within the WordPress installation, as the plugin’s data handling routines are identical across these versions.

With a CVSS score of 6.5 the issue falls into the moderate severity category. The EPSS score of less than 1% indicates that, as of the latest data, exploitation is unlikely at the moment, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector could be web‑based, where an authenticated or unauthenticated attacker accesses backup files or plugin interfaces that expose subscriber data. Thus the risk is moderate but the likelihood of immediate exploitation remains low; however, the potential for data exposure warrants prompt action.