This vulnerability in SendPulse Email Marketing Newsletter (<= 2.2.1) permits an attacker with limited privileges to access sensitive system information embedded within the application. The exposure could potentially aid in further attacks or information gathering but does not directly impact integrity or availability. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and no user interaction required, with confidentiality impact limited to partial information disclosure.

The impact is limited to the unauthorized disclosure of sensitive system information, which could facilitate reconnaissance or subsequent attacks. There is no direct impact on system integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected application to trusted users only and review permissions to minimize exposure.