The vulnerability CVE-2025-58656 in the Estonian Shipping Methods for WooCommerce plugin arises from the use of hard-coded credentials embedded within the software. This flaw allows an attacker to retrieve sensitive data embedded in the plugin without requiring privileges or user interaction. The affected versions include all releases up to 1.7.2. The CVSS 3.1 base score is 5.3, reflecting a network attack vector, low complexity, no privileges required, and confidentiality impact limited to partial data disclosure. No known exploits are reported in the wild, and no official patch or mitigation guidance is currently available.

An attacker can remotely retrieve embedded sensitive data due to hard-coded credentials in the plugin, potentially leading to partial confidentiality loss. The vulnerability does not impact integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin versions to reduce exposure.