This vulnerability in the Site Info plugin by Rami Yushuvaev allows unauthorized control spheres to retrieve embedded sensitive system information. It affects versions up to and including 1.1. The CVSS 3.1 base score is 2.7, indicating low severity, with network attack vector, low complexity, and requiring high privileges. The vulnerability impacts confidentiality only, with no impact on integrity or availability. No known exploits are reported in the wild, and no patch or remediation details are currently available.

The vulnerability allows unauthorized disclosure of sensitive system information, which could aid an attacker with high privileges in further reconnaissance or attack planning. However, the impact is limited to confidentiality with no direct effect on system integrity or availability. Exploitation requires high privileges, reducing the likelihood of exploitation by low-privileged attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. In the meantime, restrict access to the Site Info plugin to trusted administrators only to minimize exposure.