CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.
Explanation of Vulnerability in Simple Terms
g-FFL Cockpit versions 1.7.1 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. An attacker can access the application over the network without credentials or user interaction. The vulnerability exposes confidential data but does not allow modification or service disruption.
What an attacker can do
Read sensitive information from the application without logging in.
Potential impact on your site
Confidential data stored in g-FFL Cockpit may be exposed to unauthorized parties.
Conditions required to exploit
Network access to the g-FFL Cockpit instance; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
