The vulnerability identified as CVE-2025-64272 affects the GetResponse Email marketing plugin for WordPress by GetResponse Official. It involves exposure of sensitive system information to an unauthorized control sphere, allowing retrieval of embedded sensitive data. The issue impacts versions up to 1.5.3. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely over the network with low attack complexity, requires privileges, does not require user interaction, affects confidentiality with high impact, but does not affect integrity or availability.

An attacker with some level of privileges on the affected WordPress installation can retrieve sensitive system information, potentially leading to information disclosure that could aid further attacks. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the WordPress admin interface to untrusted networks.