The External Login plugin for WordPress suffers from an information exposure vulnerability (CWE-200) due to insufficient access control on the 'exlog_test_connection' AJAX action. This action lacks both capability checks and nonce validation, enabling authenticated users with minimal privileges (subscriber and above) to access sensitive data from the configured external database. The exposed data includes truncated usernames, email addresses, and password hashes, which could aid an attacker in further attacks. The vulnerability affects all versions up to and including 1.11.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, resulting in limited confidentiality impact without integrity or availability effects. There is no vendor advisory or patch information available at this time.

An attacker with subscriber-level access or higher can exploit this vulnerability to obtain sensitive information such as truncated usernames, email addresses, and password hashes from the external database configured in the plugin. While the integrity and availability of the system are not affected, the confidentiality breach could facilitate further attacks like phishing or password cracking attempts. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to the 'exlog_test_connection' AJAX action. Consider disabling or removing the External Login plugin if it is not essential.