The Vimeo WordPress plugin in versions 1.2.2 or earlier contains a flaw that allows an attacker to read subscriber information stored by the plugin. This vulnerability is classified as a Sensitive Data Exposure (CWE-201), meaning that confidentiality is compromised when an unauthenticated or authorized user can access data that should be protected. The impact is the disclosure of subscriber personal data, which could lead to privacy violations or further exploitation if the data is used in credential stuffing or targeted phishing.

WordPress installations that use the Vimeo plugin version 1.2.2 or earlier, developed by vimeodev, are affected. The plugin is widely employed to embed Vimeo videos, and any site that has not upgraded beyond 1.2.2 is potentially vulnerable.

Based on the CVE data, the vulnerability has a CVSS score of 7.5, indicating high severity. The EPSS score is not provided, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, implying that publicly known exploits are not documented. No explicit attack vector or exploitation conditions are described in the CVE description, so it is unclear whether the vulnerability is exploitable remotely, locally, or through the web interface. The vulnerability’s impact is the unauthorized disclosure of subscriber information that the plugin stores.