CVE-2025-8484 describes a sensitive information exposure vulnerability in the nickclarkweb Code Quality Control Tool WordPress plugin, version 2.1. The issue arises because log files are publicly accessible, enabling unauthenticated attackers to access potentially sensitive data contained within these logs. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss without affecting integrity or availability.

An unauthenticated attacker can access sensitive information stored in publicly exposed log files of the affected plugin. This exposure could lead to information disclosure that may assist further attacks or compromise privacy. There is no indication of impact on data integrity or system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should consider restricting access to the plugin's log files by configuring web server permissions or using other access control mechanisms to prevent unauthorized public access until an official fix is released.