CVE-2025-11379: WebP Express Information Disclosure Flaw

CVE-2025-11379 Overview

CVE-2025-11379 is an information exposure vulnerability affecting the WebP Express plugin for WordPress. The flaw exists in all versions up to and including 0.25.9. The plugin fails to properly randomize the name of its configuration file, allowing direct file access on NGINX-based deployments. Unauthenticated attackers can retrieve configuration data over the network without any user interaction. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve WebP Express configuration data from WordPress sites running on NGINX, exposing internal settings that may facilitate further attacks.

Affected Products

WordPress WebP Express plugin versions 0.25.9 and earlier
WordPress sites served by NGINX with the plugin installed
Environments relying on the plugin's default configuration file naming

Discovery Timeline

2025-12-04 - CVE CVE-2025-11379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11379

Vulnerability Analysis

The WebP Express plugin stores configuration data in a file whose path is predictable on NGINX deployments. Apache environments typically block direct access to plugin configuration through .htaccess rules, but NGINX ignores those directives. Because the plugin does not randomize the configuration file name, an attacker can request the file directly through the web server. The response reveals plugin configuration values that would otherwise remain internal to the WordPress installation. The EPSS probability is 0.271% (percentile 18.755), indicating low observed exploitation activity at time of scoring.

Root Cause

The root cause is a design flaw in file placement and naming. The plugin relies on web-server-level access controls that only exist on Apache. On NGINX, no equivalent rewrite or deny rule is applied by default. Combined with a static, guessable file name, this allows the configuration file to be fetched as a static asset.

Attack Vector

An unauthenticated remote attacker sends an HTTP GET request to the known configuration file path exposed by the plugin. When the WordPress site runs behind NGINX, the file is served directly. The attacker parses the returned content to extract configuration values such as conversion options, paths, and quality settings that may aid reconnaissance or subsequent attacks.

No verified exploitation code is publicly indexed. The vulnerability mechanism is described in the Wordfence Vulnerability Report and the WordPress Plugin Change Log.

Detection Methods for CVE-2025-11379

Indicators of Compromise

Unauthenticated HTTP GET requests targeting WebP Express plugin paths under /wp-content/plugins/webp-express/ returning 200 OK for configuration-like content
Access log entries from external IPs requesting files with .json or configuration extensions inside the plugin directory
Repeated scanning patterns enumerating known WordPress plugin file paths from a single source

Detection Strategies

Review NGINX access logs for direct requests to WebP Express configuration files served with status 200
Correlate WordPress plugin inventory with running WebP Express versions less than or equal to 0.25.9
Add web application firewall rules to alert on requests to known plugin configuration paths

Monitoring Recommendations

Enable verbose access logging on NGINX for all /wp-content/plugins/ paths
Monitor egress of configuration file bytes to unauthenticated sources
Track WordPress plugin update events to confirm remediation across managed sites

How to Mitigate CVE-2025-11379

Immediate Actions Required

Update the WebP Express plugin to a version later than 0.25.9 as published on the WebP Express Plugin Page
Audit NGINX configurations to explicitly deny direct access to plugin configuration files
Inventory all WordPress sites for the affected plugin version using centralized management tooling

Patch Information

The vendor addressed the issue by changing the configuration file handling. Details are available in the WordPress Plugin Change Log. Administrators should update to the latest available release via the WordPress plugin dashboard or wp-cli.

Workarounds

Add NGINX location blocks to deny access to WebP Express configuration file paths
Restrict access to the /wp-content/plugins/webp-express/ directory through server-level rules
Disable the plugin until a patched version is deployed if updates cannot be applied immediately

bash

# NGINX configuration example to deny direct config access
location ~* /wp-content/plugins/webp-express/.*\.(json|php-example|txt)$ {
    deny all;
    return 403;
}