The vulnerability arises from a missing authorization check in the RepairBuddy plugin, allowing unauthenticated users to retrieve embedded sensitive data. This flaw permits attackers to access confidential information that should be protected, potentially compromising the privacy and integrity of the affected WordPress site. The weakness corresponds to CWE-862, which denotes unauthorized access or privilege escalation.

Affected systems include installations of the Webful Creations RepairBuddy plugin for WordPress through version 4.1226. Users of the plugin in any WordPress environment that has not applied the latest patch are at risk.

The CVSS score of 7.1 indicates a high severity of potential data exposure. The EPSS score is not available, so exploitation likelihood is unclear, yet the absence of a KEV listing suggests no known public exploits yet. Attackers can exploit the flaw without any authentication, making it a simple, remote data disclosure vector that can be leveraged directly against the vulnerable plugin.