The vulnerability arises in GiveWP plugin versions 4.16.9 and earlier, allowing an attacker to obtain sensitive subscriber data. This flaw can lead to the disclosure of personally identifiable information, jeopardizing client confidentiality. The weakness is classified as an information disclosure vulnerability (CWE-862).

WordPress sites running the GiveWP plugin from the Nexcess vendor, specifically all versions up to and including 4.16.9, are susceptible. Sites must upgrade to version 4.17.0 or later to eliminate the flaw.

The CVSS score of 6.5 indicates a medium severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The exploitability is likely to require access to the plugin's subscriber endpoints; based on the description it is inferred that an attacker can retrieve subscriber data through publicly accessible routes or by leveraging authenticated requests to the plugin. As such, the risk to affected sites is moderate, with potential for privacy violations if exploited.