Technical impact
The CVE describes a vulnerability in the Tips and Tricks HQ WP eMember plugin that allows an unauthorized control sphere to retrieve embedded sensitive data. This can expose confidential system information to users who are not granted access by the plugin. The weakness is identified as CWE‑497, indicating improper protection of sensitive system information from unauthorized access.
Affected Systems
Users running any version of the WP eMember plugin from the earliest available release up to v10.2.2 on WordPress sites are affected. The vulnerability exists in all of those releases, so any site with the plugin installed and not updated beyond v10.2.2 is at risk.
Risk and Exploitability
The CVSS score of 5.3 rates this vulnerability as moderate. Because no EPSS score is available and the CVE is not listed in CISA KEV, the likelihood of active exploitation is currently unknown. Based on the description, the plugin’s interface or administrative functions appear to allow data retrieval, so the likelihood of the attack vector is inferred to be the plugin’s exposed interface. An attacker could exploit this if they have some level of access to the site, such as through an existing user account or by compromising the WordPress installation.
