The Ultimate WordPress Toolkit – WP Extended plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the download_user_ajax function affecting all versions up to 3.0.8. Authenticated attackers with Subscriber-level privileges can extract sensitive user data including usernames, hashed passwords, and emails. The vulnerability is network exploitable with low attack complexity and no user interaction required. The CVSS 3.1 base score is 6.5 (medium severity), reflecting high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented in the provided data.

An attacker with at least Subscriber-level access to a vulnerable WordPress site can retrieve sensitive user information such as usernames, hashed passwords, and email addresses. This exposure could facilitate further attacks like credential cracking or phishing. The vulnerability does not affect system integrity or availability but compromises user data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity. Consider disabling or removing the plugin if sensitive data exposure risk is unacceptable.