G5Plus April CVE-2026-39714

Risk assessment integrates multiple signals: CVSS 5.3 (Network vector, Low complexity, No privilege required, confidentiality impact, no integrity/availability impact) indicates a moderate baseline severity for remote information disclosure. However, EPSS score of 0.02% (percentile 4%) reflects very low real-world exploitation probability, placing this in the lowest quartile of exploitability despite the moderate CVSS. CISA SSVC framework confirms this low urgency: exploitation status is 'none' (no active exploitation observed), automatable impact is 'no' (likely requires manual interaction or specific configuration), and technical impact is only 'partial' (limited to information disclosure, no system compromise). The contradiction between CVSS and EPSS/SSVC is typical of authorization vulnerabilities affecting shared hosting and WordPress themes-high CVSS due to unauthenticated network access, but low real exploitation due to theme-specific context and configuration requirements. This is a real but low-priority vulnerability suitable for routine patching schedules rather than emergency response.

An unauthenticated remote attacker could enumerate or directly access G5Plus April theme resources intended to be restricted to authenticated users or specific roles (e.g., administrative pages, user data, or settings pages), extracting information such as theme configuration details or potentially sensitive metadata. Exploitation requires only network access and knowledge of the vulnerable resource path; the low EPSS score suggests this attack is rarely observed in practice and likely requires specific or outdated theme configurations to succeed.