This vulnerability in mdedev's Run Contests, Raffles, and Giveaways with ContestsWP plugin (up to version 2.0.7) allows an attacker to expose sensitive system information without authentication. The issue resides in the contest-code-checker functionality, which improperly exposes embedded sensitive data. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is available at this time.

An attacker can remotely retrieve sensitive system information from affected installations without any authentication or user interaction. The confidentiality impact is limited, and there is no impact on integrity or availability. This could potentially aid attackers in further reconnaissance but does not directly lead to system compromise based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the contest-code-checker functionality or monitoring for unusual access patterns related to this component.