EUVD-2026-91658
GHSA-c299-27x5-pj33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
ExploitSend unauthenticated request to exposed endpoint
-
ImpactRetrieve embedded sensitive data in response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is indicated against sites running Smart One Click Setup - Complete Demo Import & Export versions up to and including 1.4.3 (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment: the target must have this specific plugin installed and active. The provided description does not name the exact feature, endpoint, or configuration that exposes the data, so the precise prerequisite beyond having the vulnerable plugin version installed cannot be confirmed from available data. |
| Impact | This is a low-to-moderate priority issue despite being network-exploitable without authentication. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that an unauthenticated remote attacker can retrieve embedded sensitive data with low attack complexity, but the impact is confined to a partial confidentiality breach - no integrity or availability impact (C:L/I:N/A:N). No EPSS score, SSVC decision data, KEV listing, or POC reference was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these amplifying signals, combined with the limited confidentiality-only impact and the niche footprint of this specific WordPress plugin, suggests this is a genuine but modest-severity information-disclosure flaw rather than an urgent widespread threat. CWE-201 (Insertion of Sensitive Information Into Sent Data) aligns consistently with the C:L/I:N/A:N vector, so there is no conflict between the signals; the main limitation is that the terse Patchstack description does not specify exactly which data or endpoint is exposed. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to a WordPress site running the vulnerable Smart One Click Setup plugin (versions through 1.4.3) and receives a response containing embedded sensitive data that should not be exposed. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special conditions are needed, though no public exploit code was identified at time of analysis to confirm the exact request format. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version is specified in the available data, so the primary action is to check whether Smart One Click Setup - Complete Demo Import & Export is actually installed and active on any WordPress site you manage and to remove or deactivate it if the demo import/export functionality is not in active use - deactivation eliminates the exposure entirely, with the only trade-off being loss of that feature. If the plugin must remain enabled, treat the affected import/export functionality as untrusted: restrict access to the plugin's import/export or download endpoints (for example via a WAF rule or web-server rule blocking anonymous requests to the plugin's AJAX/REST routes), disable anonymous access to the plugin's admin-ajax or REST actions where feasible, and rotate any credentials, API keys, or tokens that may have been bundled into demo or export payloads, since leaked embedded secrets must be treated as compromised even after the plugin is removed. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/smart-one-click-setup/vulnerability/wordpress-smart-one-click-setup-complete-demo-import-amp-export-plugin-1-4-3-sensitive-data-exposure-vulnerability for a fixed release and apply it as soon as one is published. Note that because exploitation is unauthenticated and requires no user interaction, access restrictions on the endpoint are the only effective compensating control while the vulnerable version remains installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-201 (Insertion of Sensitive Information Into Sent Data), which describes code that includes secrets, credentials, configuration values, or other sensitive content inside data or responses transmitted to a client. In the WordPress plugin ecosystem this typically surfaces when a demo-content import/export feature serializes bundled demo data, template payloads, or configuration bundles and returns them through an AJAX action, REST route, admin-post handler, or downloadable export file without filtering out embedded sensitive values. The reported CPE identifies the affected product as cpe:2.3:a:chiranjit_hazarika:smart_one_click_setup_-_complete_demo_import_&_export (all versions, through 1.4.3), confirming the target is the WordPress plugin distributed by Chiranjit Hazarika rather than a standalone application. The provided description does not name the exact endpoint, parameter, or configuration that exposes the data, so the precise delivery mechanism for the leaked content cannot be confirmed from available data; what is confirmed is that the network attack vector, low attack complexity, and lack of any authentication or user-interaction requirement mean the only meaningful deployment prerequisite is having the vulnerable plugin version installed and active.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network retrieval of embedded sensitive data (PR:N, AV:N, AC:L) yields only partial confidentiality loss (C:L), with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup - Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup - Complete Demo Import & Export: from n/a through 1.4.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB