This vulnerability in the Custom Field Template plugin by Hiroaki Miyashita permits exposure of sensitive system information to unauthorized control spheres. Specifically, it allows retrieval of embedded sensitive data without requiring user interaction, with an attack vector over the network and low attack complexity. The affected versions are up to 2.7.6. The CVSS 3.1 base score is 4.3, reflecting a confidentiality impact but no integrity or availability impact. No patches or vendor advisories have been provided to confirm remediation status.

An attacker with limited privileges can access sensitive system information embedded within the plugin, potentially aiding further attacks or information gathering. The impact is limited to confidentiality loss; integrity and availability are not affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and sensitive data where possible and monitor for updates from the vendor.