This vulnerability, tracked as CVE-2025-31051 and classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects the EngoTheme Plant - Gardening & Houseplants WordPress Theme up to version 1.0.0. It allows an attacker with network access and no privileges or user interaction to retrieve embedded sensitive data from the system. The CVSS 3.1 base score is 5.3, reflecting a medium severity with confidentiality impact only. No integrity or availability impacts are noted. There is no vendor-provided patch or advisory detailing remediation steps.

An attacker can gain access to sensitive system information without authentication or user interaction, which could aid in further attacks or information gathering. However, the vulnerability does not allow modification or disruption of the system, limiting the impact to confidentiality only. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected WordPress theme and monitor for updates from EngoTheme. No vendor advisory or patch links are currently available.