phpMyFAQ versions prior to 4.1.7 do not validate the active status of a FAQ entry when generating a PDF export, allowing an unauthenticated user to retrieve metadata about draft or unpublished FAQs. This weakness is a form of Information Disclosure (CWE-200) and exposes the title, solution ID, author name, and last‑update timestamp of these inactive records. The flaw can reveal internal organizational information without granting any modification privileges.

The vulnerability affects PHP applications using Thorsten’s phpMyFAQ component before release 4.1.7. Any deployment of the open‑source FAQ system that has not applied the 4.1.7 update or later is susceptible.

The CVSS score of 6.9 classifies the issue as medium severity. The EPSS score is <1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the PDF export endpoint is publicly reachable; an attacker only needs to know or guess sequential FAQ identifiers to enumerate and exfiltrate the sensitive metadata. Because no authentication is required, the exploitation barrier is low, making it a practical target for threat actors scanning for exposed FAQ data.