PT-2025-49003 · WordPress · Webp-Express

Rafshanzani Suhada · Published 2025-12-04 · Updated 2025-12-04 · CVE-2025-11379

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebP Express versions prior to 0.25.9

Description The WebP Express plugin for WordPress is susceptible to information disclosure through improperly randomized config file names when used with NGINX. This allows unauthenticated attackers to extract configuration data. The plugin does not properly randomize the name of the config file, enabling direct access.

Recommendations Update the WebP Express plugin to a version newer than 0.25.9.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-11379

Affected Products

Webp-Express

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11379 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c28479bf-768a-4ab4-8e74-ad367b9b744f?source=cve · Note
• https://wordpress.org/plugins/webp-express · Note
• https://twitter.com/CVEnew/status/1996442207306297350 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996454432851042655 · Twitter Post
• https://t.me/cveNotify/144708 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425653%40webp-express&new=3425653%40webp-express&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/38803 · Telegram Post