{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2881", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-27T19:40:35.544Z", "datePublished": "2025-04-12T02:23:15.245Z", "dateUpdated": "2026-04-08T17:28:51.373Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:51.373Z"}, "affected": [{"vendor": "bap22", "product": "Developer Toolbar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file."}], "title": "Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e10ba37a-cd7d-4fc9-8b41-806fa3dc7785?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/developer-toolbar/trunk/views/phpinfo.php#L45"}, {"url": "https://wordpress.org/plugins/developer-toolbar/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "timeline": [{"time": "2025-04-11T14:19:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T16:31:42.265430Z", "id": "CVE-2025-2881", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T16:33:17.541Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2881", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T16:31:42.265430Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T16:33:12.723Z"}}], "cna": {"title": "Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Avraham Shemesh"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "bap22", "product": "Developer Toolbar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-11T14:19:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e10ba37a-cd7d-4fc9-8b41-806fa3dc7785?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/developer-toolbar/trunk/views/phpinfo.php#L45"}, {"url": "https://wordpress.org/plugins/developer-toolbar/#developers"}], "descriptions": [{"lang": "en", "value": "The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:51.373Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2881", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:51.373Z", "dateReserved": "2025-03-27T19:40:35.544Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-12T02:23:15.245Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file."}, {"lang": "es", "value": "El complemento Developer Toolbar de WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 1.0.3 incluida, a trav\u00e9s del script phpinfo.php, de acceso p\u00fablico. Esto permite que atacantes no autenticados accedan a informaci\u00f3n potencialmente sensible contenida en el archivo expuesto."}], "id": "CVE-2025-2881", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-04-12T03:15:14.430", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/developer-toolbar/trunk/views/phpinfo.php#L45"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/developer-toolbar/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e10ba37a-cd7d-4fc9-8b41-806fa3dc7785?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:17:11.279442+00:00", "value": {"mitigation_remediation": ["Upgrade the Developer Toolbar plugin to the latest version (1.0.4 or later).", "Remove or rename the phpinfo.php file from the plugin directory to prevent public access.", "Configure the web server or use a security plugin to deny access to all debugging files for non\u2011admin users."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the Developer Toolbar plugin at version 1.0.3 or earlier. The plugin is distributed by the vendor bap22 and is available through the WordPress plugin repository.", "description_and_impact": "The vulnerability is a publicly accessible phpinfo.php script in the Developer Toolbar plugin for WordPress that allows anyone to retrieve detailed PHP environment information without authentication. This leads to sensitive information exposure such as configuration settings, database credentials, and potential server secrets, representing a CWE\u2011200 weakness.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% shows a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. An attacker can perform the exploit simply by requesting the phpinfo.php endpoint via HTTP, with no authentication required, thereby gaining access to confidential PHP configuration information. The impact is primarily confidentiality loss; there is no evidence of code execution or denial of service from this flaw."}}}}, "created": "2025-07-12T22:15:50.570198+00:00", "updated": "2026-04-20T23:30:16.103527+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}