The WP-LESS plugin for WordPress, developed by thom4, contains a vulnerability identified as CVE-2025-31550. This vulnerability allows an attacker to cause insertion of sensitive information into files or directories that are externally accessible, enabling retrieval of embedded sensitive data. It affects all versions up to 1.9.6. The CVSS v3.1 base score is 5.8, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and partial confidentiality impact. No official patch or remediation guidance has been published by the vendor or in the advisory data.

An attacker can remotely exploit this vulnerability without authentication or user interaction to retrieve sensitive information that has been inserted into externally accessible files or directories by the WP-LESS plugin. The confidentiality of some data is compromised, but integrity and availability are not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to files and directories created or modified by WP-LESS to prevent unauthorized external access. Monitor official vendor channels for updates and patches.