Note by Patchstack

The vendor has implemented measures to notify users about potential API misuse when the API key is not restricted to requests from defined domain names or IP addresses. The exposure of the API key is now considered logic by design. Users are informed about the associated risks, and additional safeguards will be introduced on the API key creation and management page.

This could allow a malicious actor to view sensitive information that is normally not available to regular users. This can be used to exploit other weaknesses in the system.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Update to version 3.10.0 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.