The vulnerability allows an unauthenticated attacker to read sensitive data stored or displayed by the WordPress WCBoost – Products Compare plugin. Because the plugin does not enforce proper access control, any visitor can retrieve protected information. This weakness matches CWE‑497 and can expose customer details, order history, or other private information, compromising confidentiality but not necessarily integrity or availability.

Plugins distributed under WCBoost – Products Compare version 1.1.0 or earlier on WordPress sites are affected. Site administrators must audit their WordPress installations for this plugin and verify the installed version. No other WordPress plugins or core components are listed as vulnerable.

The CVSS score is 5.3, indicating moderate severity. Because the exploitation path requires no authentication, the risk of accidental discovery is higher, though the EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Attackers can trigger the flaw by accessing a publicly exposed endpoint, inferred from the unauthenticated description. The absence of a KEV listing suggests no widespread exploitation yet, but the moderate CVSS and open access warrant prompt remediation.