The vulnerability arises because the plugin does not restrict direct access to the generate-default.php file, which reveals the full path of the web application to unauthenticated users. This information disclosure is a result of the plugin's use of the cocur library without proper access controls. The exposure of the full path can aid attackers in crafting more targeted attacks but does not itself compromise confidentiality, integrity, or availability beyond information disclosure. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, causing limited confidentiality impact without integrity or availability impact.

An attacker can obtain the full filesystem path of the affected web application without authentication. This information disclosure is limited in impact and does not directly allow data modification or service disruption. However, it can be leveraged in conjunction with other vulnerabilities to facilitate more damaging attacks. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the generate-default.php file via web server configuration or other access control mechanisms to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once available.