Overview
CVE-2025-11379 is a medium-severity vulnerability affecting the WebP Express plugin for WordPress, versions 0.25.9 and earlier. This vulnerability allows unauthenticated attackers to potentially extract sensitive configuration data due to improper randomization of the configuration file name, particularly when the plugin is used with NGINX web servers. This flaw exposes configuration details that could be leveraged for further malicious activities.
Technical Details
The core issue lies in the WebP Express plugin’s failure to adequately randomize the name of its configuration file. In NGINX environments, this predictable file name makes it possible for an attacker to directly access the file via a web request. The configuration file contains sensitive information such as API keys, database credentials (though less likely directly, it could point to other config files), or other internal settings required for the plugin to function. Access to this data enables attackers to gain insights into the WordPress site’s configuration and potentially escalate their attack.
CVSS Analysis
- Severity: MEDIUM
- CVSS Score: 5.3
The CVSS score of 5.3 indicates a medium severity. While direct system compromise isn’t immediately possible, the exposed configuration data represents a significant risk because it can be used to facilitate more severe attacks. The exploitability metric is relatively high due to the ease of accessing the configuration file, given the predictable naming scheme.
Possible Impact
Successful exploitation of CVE-2025-11379 could lead to:
- Information Disclosure: Exposure of sensitive configuration details.
- Account Takeover: Gaining access to API keys or other credentials.
- Further Exploitation: Using exposed information to identify and exploit other vulnerabilities within the WordPress installation or associated services.
- Data Breach: Potentially indirect access to sensitive data if the configuration file contains information that leads to database access or other sensitive areas.
Mitigation or Patch Steps
The primary mitigation step is to update the WebP Express plugin to the latest version. If an update is not yet available or feasible, consider the following temporary measures:
- Implement NGINX rules: Block direct access to the configuration file (the exact filename will vary based on the specific plugin version). A `location` block in your NGINX configuration can be used to deny access to specific files or directories.
- Web Application Firewall (WAF): Employ a WAF to detect and block requests attempting to access the configuration file.
- Review Configuration: If possible, review the contents of the vulnerable configuration file and ensure that any sensitive information is rotated or invalidated.
References
WebP Express Plugin Page
Wordfence Vulnerability Report for CVE-2025-11379
