Mindio Magic Mcp
Monthly
Sensitive information embedded in outbound responses from the Mindio Magic MCP WordPress plugin (versions through 0.5.6) can be retrieved by a remote, authenticated attacker holding only low-level privileges on the affected site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The flaw is a CWE-201 'Insertion of Sensitive Information Into Sent Data' condition, meaning the plugin places data into responses it transmits rather than leaking it through a separate storage or traversal bug. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low-to-moderate. The CVSS base score of 4.3 reflects that an attacker must already possess a valid WordPress account on the target site before the disclosure is reachable.
Sensitive information embedded in outbound responses from the Mindio Magic MCP WordPress plugin (versions through 0.5.6) can be retrieved by a remote, authenticated attacker holding only low-level privileges on the affected site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The flaw is a CWE-201 'Insertion of Sensitive Information Into Sent Data' condition, meaning the plugin places data into responses it transmits rather than leaking it through a separate storage or traversal bug. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low-to-moderate. The CVSS base score of 4.3 reflects that an attacker must already possess a valid WordPress account on the target site before the disclosure is reachable.