WebP Express WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure through configuration files has been identified in the WebP Express plugin for WordPress, affecting all versions up to and including 0.25.9. The issue arises because the plugin fails to adequately randomize the names of configuration files, leaving them accessible on NGINX. This flaw enables unauthenticated attackers to retrieve sensitive configuration data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive configuration information.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.