The Object Cache 4 everyone plugin in WordPress versions up to 2.3.2 contains an unauthenticated sensitive data exposure flaw. The bug allows an attacker to retrieve private or confidential information without requiring any credentials. Because the vulnerability is based on improper access control (CWE-201), it can lead to disclosure of sensitive user data, plugin configuration details, or other private information kept in the cache.

Affected systems are WordPress sites that have installed the fpuenteonline:Object Cache 4 everyone plugin with a version equal to or older than 2.3.2. The plugin version information may not be explicitly listed in CPE strings, but any site running the plugin before the 2.3.3 release is vulnerable.

The CVSS score is 7.5, indicating a high likelihood of significant impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the plugin’s exposed interfaces or configuration pages, which can be accessed by unauthenticated users. An attacker can exploit the flaw simply by sending a request to the vulnerable endpoint and reading the returned data, resulting in confidentiality loss.