Host PHP Info WordPress Plugin Missing Authorization Vulnerability in Sensitive Information Disclosure

A vulnerability exists in the Host PHP Info plugin for WordPress, all versions through 1.0.4, due to a lack of proper capability checks. This flaw allows unauthenticated attackers to access sensitive data by reading server configuration settings and predefined variables. Notably, the vulnerability can be exploited even if the plugin is not activated.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive server information, including configuration settings and predefined variables.

Remediation

There is no known patch available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.