The vulnerability CVE-2025-58656 in the Estonian Shipping Methods for WooCommerce plugin arises from the use of hard-coded credentials embedded within the software. This flaw permits unauthorized retrieval of sensitive data embedded in the plugin. It affects all versions up to 1.7.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the vulnerability can be exploited remotely without privileges or user interaction, resulting in limited confidentiality impact. No known exploits in the wild have been reported, and no vendor patch or advisory is currently available.

An attacker can remotely retrieve sensitive data embedded in the plugin due to hard-coded credentials. The confidentiality impact is limited, with no impact on integrity or availability. This could potentially expose sensitive information but does not allow modification or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin or monitoring for unusual activity related to this plugin. Avoid exposing the plugin to untrusted networks if possible.