CVE-2025-57916 MEDIUM

CVE-2025-57916: WordPress WP System Information Plugin <= 1.5 - Sensitive Data Exposure Vulnerability

Vendor Nurul Amin
Product WP System Information
Weakness CWE-497
Published September 22, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Nurul Amin WP System Information wp-system-info allows Retrieve Embedded Sensitive Data.This issue affects WP System Information: from n/a through <= 1.5.

Explanation of Vulnerability in Simple Terms

02Summary

WP System Information versions 1.5 and earlier expose sensitive system information to authenticated users without proper access controls. An attacker with a low-privilege account can read details about the site's server configuration, PHP version, and other system data. This information disclosure can aid in planning further attacks against the WordPress installation.

What an attacker can do

03Attacker Capabilities

Read sensitive server and system configuration details via the plugin.

Potential impact on your site

04Site Impact

System information that could help attackers plan targeted attacks is exposed to any logged-in user.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (subscriber or higher).

Key dates

06Disclosure timeline

September 22, 2025 CVE published
April 28, 2026 Record updated