CVE-2025-12721

Description

The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.

PUBLISHED Reserved 2025-11-04 | Published 2025-12-06 | Updated 2025-12-06 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Ryan Kozak finder

References

www.wordfence.com/...-081c-4671-ad1e-3caf004669dd?source=cve

plugins.trac.wordpress.org/...cludes/class-sync-endpoint.php

github.com/d0n601/CVE-2025-12721

ryankozak.com/posts/cve-2025-12721/

cve.org (CVE-2025-12721)

nvd.nist.gov (CVE-2025-12721)