The vulnerability exists in WordPress Coupon Affiliates plugin versions 7.8.1 and earlier, where subscriber sensitive data can be exposed without proper access controls. This flaw, classified as CWE-497, allows unintended disclosure of confidential subscriber information. The impact is loss of confidentiality for subscribers and could facilitate further attacks if the exposed data is leveraged.

RelyWP’s Coupon Affiliates plugin, a WordPress extension, is affected in all releases up to and including version 7.8.1. The vulnerability affects website installations that have not upgraded beyond this version.

The CVSS score of 7.5 indicates a medium‑to‑high severity. The EPSS score is below 1%, suggesting that the probability of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through web‑based API or admin requests to the plugin, enabling an attacker to retrieve subscriber data. Successful exploitation would provide an attacker with confidential information without requiring privileged credentials, assuming the plugin lacks proper authentication checks on the exposed endpoints.