The vulnerability identified as CVE-2025-62902 affects the ThemeHunk WP Popup Builder WordPress plugin up to version 1.3.8. It allows an attacker with network access to retrieve sensitive system information embedded within the plugin, without requiring authentication or user interaction. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, impacting confidentiality only. There is no indication of known exploits in the wild or a vendor patch available at this time.

An attacker can obtain sensitive system information from the affected plugin without authentication, potentially aiding further attacks or reconnaissance. The impact is limited to confidentiality loss; integrity and availability are not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected plugin where possible and monitor for unusual access patterns. Avoid exposing the plugin to untrusted networks.