ShopMagic CVE-2026-114195

The description states sensitive information is inserted into an externally-accessible file or directory and can be retrieved, but the exact trigger, endpoint, or file path is not described in the available sources. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication, no user interaction, and low attack complexity against a reachable ShopMagic installation, so no special configuration is documented as a prerequisite. The principal limiting factor is the scope of what is exposed: impact is confidentiality-only and rated Low (C:L), meaning partial data disclosure rather than full account or site compromise; whether a non-default configuration narrows applicability is not stated in the available sources.

This is a moderate-severity information disclosure flaw, not a top-tier priority. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated issue with only limited confidentiality impact and no integrity or availability effect - consistent with CWE-538 (sensitive information placed into an externally-accessible file or directory). No EPSS score, CISA KEV listing, or SSVC exploitation/automatable values were provided, so exploitation-probability and automatability cannot be quantified from the input. There is no public exploit identified at time of analysis - the only reference is the Patchstack database advisory, not a working PoC. The vuln.today decision label is 'this_month', signalling a routine patch-cycle priority rather than act_now/emergency. The main caveats: the description states 'Retrieve Embedded Sensitive Data' but does not describe the trigger, the exact exposed file/endpoint, or what data is leaked, and no affected lower bound ('from n/a') or fixed version is given - these gaps should be verified against the Patchstack advisory and the vendor.

A remote, unauthenticated attacker requests an externally-accessible file or endpoint created or exposed by the ShopMagic plugin and reads embedded sensitive data from the response, without needing credentials or user interaction (AV:N/PR:N/UI:N). The low confidentiality-only impact (C:L) means the exposure is partial rather than a full compromise. No public exploit identified at time of analysis; the specific file/endpoint and the nature of the leaked data are not described in the available sources.