The vulnerability causes MaxMind credentials to be leaked through request URLs, resulting in an unintended exposure of sensitive authentication information. This is an example of improper disclosure of information (CWE-200). If an attacker obtains these credentials, they can potentially access MaxMind services or related resources that rely on those keys, leading to a breach of confidentiality and potentially undermining downstream security controls.

The affected product is the GeoIP extension for Joomla provided by regularlabs.com. Current information lacks specific version details, so all installations of this extension are presumed vulnerable until a fix is applied.

Although the EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, the CVSS score of 7.5 indicates a high severity impact. The attack vector remains accessible: any observer of network traffic or logs could capture the URLs containing the leaked credentials. The directness of the leak creates a high impact for confidentiality, but the low probability of exploitation coupled with the lack of publicly available exploits mitigates overall severity. Nonetheless, the credential exposure warrants prompt remediation.