The Open Graph plugin for WordPress, developed by willnorris, contains a sensitive information exposure vulnerability (CWE-200) in all versions up to and including 1.11.2. The issue arises from the 'opengraph_default_description' function, which improperly discloses partial content of password-protected blog posts to unauthenticated users. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no evidence of known exploits in the wild, and no patch or official fix has been documented at this time.

An unauthenticated attacker can extract sensitive data, specifically partial content from password-protected blog posts, leading to confidentiality loss. There is no impact on data integrity or availability. The exposure could potentially reveal information intended to be restricted to authorized users only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Open Graph plugin or restricting access to affected content through alternative means. Monitor vendor channels for updates and apply patches promptly once available.