Smart One Click Setup Complete Demo Import Amp Export
Monthly
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.