The vulnerability identified as CVE-2025-58269 affects the weDevs WP Project Manager plugin for WordPress, specifically versions up to 2.6.25. It involves the use of hard-coded credentials within the software, which can be exploited to retrieve embedded sensitive data. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss without affecting integrity or availability. There is no vendor advisory or patch link currently available, and no known exploits in the wild have been reported.

An attacker can remotely retrieve sensitive data embedded in the plugin due to hard-coded credentials, potentially exposing confidential information. The vulnerability does not allow modification or disruption of the system, as integrity and availability impacts are not present. The medium severity rating reflects the confidentiality impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected plugin, monitor for updates from weDevs, and avoid deploying the affected versions in sensitive environments. No official patch or temporary fix information is currently available.