The vulnerability allows an attacker who has access to a user data export ZIP file to read a plaintext TOTP shared secret. Possessing the seed enables the attacker to generate one‑time passwords that satisfy the MFA requirement and gain unauthorized login. This jeopardises confidentiality and integrity of user accounts but does not directly compromise the system itself, hence the moderate CVSS score.

Any installation of phpMyFAQ older than version 4.1.8 is affected, regardless of sub‑release. The issue originates in the export functionality that bundles user authentication data into the ZIP archive.

The CVSS v3.1 score of 5.3 indicates moderate severity. No EPSS or KEV listing suggests limited public exploitation or missing community engagement data. Attackers would need to obtain or intercept an exported ZIP, which is typically conducted by a compromised user account or an attacker who has gained file‑system or database access. Upon acquisition, the exported secret can be used immediately to bypass MFA without further action.