PT-2025-13605 · WordPress · Dap To Autoresponders Email Syncing

Avraham Shemesh · Published 2025-03-29 · Updated 2025-03-29 · CVE-2025-2840

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DAP to Autoresponders Email Syncing plugin for WordPress versions 1.0 and earlier

Description The issue allows unauthenticated attackers to view potentially sensitive information through the publicly accessible phpinfo.php script. This makes it possible for attackers to access information that could be used for further exploitation.

Recommendations For DAP to Autoresponders Email Syncing plugin for WordPress versions 1.0 and earlier, consider restricting access to the phpinfo.php script to prevent information disclosure until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-2840

Affected Products

Dap To Autoresponders Email Syncing

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-2840 · Security Note
• https://twitter.com/WolfgangSesin/status/1905832758213058607 · Twitter Post
• https://plugins.trac.wordpress.org/browser/dap-to-autoresponders-daar/trunk/infusionsoft_src/phpinfo.php#L3 · Note
• https://twitter.com/CVEnew/status/1906038433321271767 · Twitter Post
• https://t.me/cvedetector/21503 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3ff90774-f5f6-4d9c-9565-1cff31f9bec4?source=cve · Note
• https://t.me/cvetracker/20264 · Telegram Post
• https://t.me/cvenotify/116920 · Telegram Post
• https://wordpress.org/plugins/dap-to-autoresponders-daar/#developers · Note