This vulnerability, identified as CWE-497, concerns the exposure of sensitive system information in the Payment Forms for Paystack product by kendysond. Specifically, subscriber sensitive data can be accessed by unauthorized control spheres in versions up to and including 4.0.5. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and resulting in high confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild, and no official remediation or patch is currently available.

The vulnerability allows unauthorized entities to access sensitive subscriber data, potentially leading to privacy breaches or data leakage. There is no reported impact on data integrity or system availability. The exposure could undermine trust and compliance with data protection standards.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access privileges to the affected Payment Forms for Paystack installations and monitor for unusual access patterns related to subscriber data exposure.