CVE-2025-12721
BaseFortify
Publication date: 2025-12-06
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| g-ffl | cockpit | 1.7.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability exposes extensive sensitive server and application information to unauthenticated users, which can lead to unauthorized disclosure of confidential data. This exposure violates principles of data confidentiality and least privilege, potentially impacting compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive information and proper access controls. Organizations using the affected plugin without patching may risk non-compliance due to this unauthorized information disclosure. [1, 2]
Can you explain this vulnerability to me?
The g-FFL Cockpit plugin for WordPress has a vulnerability in all versions up to 1.7.1 where unauthenticated attackers can access the /server_status REST API endpoint without proper capability checks. This allows attackers to extract sensitive information about the server.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to obtain sensitive information about your server, which could be used to facilitate further attacks or compromise the security of your system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending an unauthenticated GET request to the vulnerable REST API endpoint `/wp-json/fflcockpit/v1/server_status` on your WordPress site. If the endpoint returns detailed server and application information without requiring authentication, your system is vulnerable. A suggested command to test this is: `curl -X GET http://example.com/wp-json/fflcockpit/v1/server_status` replacing `http://example.com` with your site URL. If the response includes sensitive information such as PHP version, server load, active plugins, or database details, the vulnerability is present. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the `/server_status` REST API endpoint by implementing proper authorization checks so that only authenticated and authorized users can access it. This involves modifying the plugin code to replace the permission callback from `__return_true` to a function that verifies user capabilities or authentication status. Additionally, updating or patching the g-FFL Cockpit plugin to a version that includes these authorization checks is recommended. If patching is not immediately possible, temporarily disabling the plugin or blocking access to the endpoint via web server rules (e.g., firewall or .htaccess) can reduce exposure. [1, 2]