The flaw permits an unauthenticated attacker to access confidential information that should be protected by the plugin. By exploiting this vulnerability, an attacker can obtain sensitive data normally accessible only to authenticated users. The weakness is categorized as a CWE-201 Sensitive Data Exposure flaw.

The affected product is the WordPress plugin "Contact Form 7 – Dynamic Text Extension" from Sevenspark, versions 5.0.7 and earlier.

The CVSS score of 7.5 indicates a high severity. Although an EPSS score is not available, the absence of listing in the CISA KEV catalog suggests no confirmed exploitation yet. Based on the description, the likely attack vector involves unauthenticated web requests to the plugin’s endpoints, allowing the attacker to retrieve protected data without credentials.