CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
What the vulnerability does
The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Explanation of Vulnerability in Simple Terms
Host PHP Info versions 1.0.4 and earlier lack access controls on sensitive diagnostic pages. An unauthenticated attacker can view detailed PHP configuration, installed extensions, and server environment details without any credentials or user interaction. This information disclosure can aid further attacks against the site.
What an attacker can do
View detailed PHP configuration, installed extensions, and server environment information without authentication.
Potential impact on your site
Attackers can gather reconnaissance data about your server setup to plan targeted attacks.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
