This vulnerability in the Hustle plugin for WordPress allows an attacker with network access to retrieve embedded sensitive data without any privileges or user interaction. It is classified as an exposure of sensitive system information to an unauthorized control sphere. The CVSS v3.1 base score is 5.3, reflecting a medium severity with a network attack vector and no required privileges. The affected versions include all versions up to 7.8.9.2. No patch or vendor advisory is currently available to confirm remediation status.

An attacker can obtain sensitive system information embedded within the Hustle plugin, potentially aiding further attacks or reconnaissance. The confidentiality of data is impacted, but there is no direct impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected plugin endpoints or disabling the plugin if feasible to reduce exposure.