The 1003 Mortgage Application plugin for WordPress suffers from a Full Path Disclosure vulnerability (CWE-209) in the /inc/class/fnm/export.php file, which is publicly accessible and has error logging enabled. This allows unauthenticated attackers to retrieve the full filesystem path of the web application. The vulnerability affects all versions up to and including 1.87. The disclosed path information is considered low impact by itself but may facilitate further attacks if chained with other vulnerabilities. The CVSS 3.1 base score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can obtain the full filesystem path of the web application, which is sensitive information that can aid in further exploitation. However, this information disclosure alone does not compromise confidentiality, integrity, or availability directly. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict public access to the /inc/class/fnm/export.php file and disable error logging on production environments to prevent full path disclosure. Monitor for vendor updates regarding an official fix.