The All Bootstrap Blocks plugin for WordPress contains a flaw that allows an attacker to retrieve sensitive system information from an unauthorized control sphere. The vulnerability permits the extraction of embedded data that is not intended to be publicly accessible, potentially exposing internal configuration details and other confidential information. The impact is a compromise of confidentiality and may assist attackers in planning further exploitation.

All Bootstrap Blocks, a WordPress plugin from AREOI, is affected in every release from the earliest version through 1.3.31. Users running any of these versions are vulnerable and require attention. Versions 1.3.32 and up are assumed to be fixed, but confirmation from the vendor should be sought.

The CVSS score of 4.3 indicates moderate severity, and no EPSS score is available, so the likelihood of widespread exploitation cannot be quantified. The vulnerability is listed as not present in the CISA KEV catalog. Based on the description – exposure to an unauthorized control sphere – the likely attack vector involves a request to a plugin-protected endpoint or an administrative interface, potentially without authentication. Once accessed, the attacker can read sensitive data, aiding subsequent attacks.