Information Exposure Vulnerability in WebP Express Plugin for WordPress
CVE-2025-11379

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Webp Express
Vendor
CVE Published:
4 December 2025

What is CVE-2025-11379?

The WebP Express plugin for WordPress suffers from an information exposure vulnerability due to improper randomization of the configuration file name. This oversight allows unauthenticated attackers to gain direct access to sensitive configuration data on NGINX servers in versions up to and including 0.25.9. Such exposure can lead to serious security implementation risks and unauthorized data extraction.

Affected Version(s)

WebP Express 0 <= 0.25.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/webp-express/
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada
.