CVE-2025-12039: BigBuy Dropshipping Information Disclosure

CVE-2025-12039 Overview

CVE-2025-12039 affects the BigBuy Dropshipping Connector for WooCommerce plugin for WordPress. The plugin fails to properly validate client IP addresses and relies on user-supplied HTTP headers such as X-Forwarded-For as the primary source for IP retrieval. All versions up to and including 2.0.5 are affected. Unauthenticated attackers can spoof their apparent source IP and trigger the plugin to expose the output of phpinfo(), disclosing sensitive server configuration data. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can bypass IP-based access controls and retrieve phpinfo() output, exposing PHP configuration, environment variables, loaded modules, and server paths useful for follow-on attacks.

Affected Products

BigBuy Dropshipping Connector for WooCommerce (WordPress plugin)
All versions up to and including 2.0.5
WordPress sites running the vulnerable plugin with WooCommerce

Discovery Timeline

2025-11-21 - CVE-2025-12039 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12039

Vulnerability Analysis

The plugin exposes an API controller that gates access to diagnostic functionality, including a call to phpinfo(), based on the requesting client's IP address. Rather than reading the client IP from the trusted TCP connection (REMOTE_ADDR), the plugin trusts HTTP request headers such as X-Forwarded-For, Client-IP, or similar attacker-controllable headers. Since these headers are supplied by the client, an unauthenticated attacker can set them to any allowlisted value and pass the IP check. The vulnerable code paths reside in src/Controller/ApiController.php around lines 225 and 260 as referenced in the WordPress Plugin Code Snippet.

Root Cause

The root cause is insufficient IP address validation combined with placing implicit trust in user-supplied HTTP headers. The plugin treats forwarded-for headers as authoritative without verifying that the request traverses a trusted reverse proxy. This design pattern breaks the security assumption that access-control decisions must rely only on data the client cannot forge.

Attack Vector

An unauthenticated attacker sends an HTTP request to the vulnerable API endpoint with a forged header, for example X-Forwarded-For: 127.0.0.1, matching an IP the plugin considers authorized. The plugin parses the spoofed header, passes its internal IP allowlist check, and returns the phpinfo() output in the response body. The disclosed data includes PHP version, extension list, filesystem paths, environment variables, and other server internals that assist attackers in identifying additional exploitable weaknesses. See the Wordfence Vulnerability Analysis for further detail.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the referenced advisory and plugin source.

Detection Methods for CVE-2025-12039

Indicators of Compromise

Unexpected HTTP responses containing phpinfo() output served from the affected WordPress site.
Inbound HTTP requests to plugin API endpoints under bigbuy-wc-dropshipping-connector containing crafted X-Forwarded-For, Client-IP, X-Real-IP, or Forwarded headers.
Requests originating from external source IPs but presenting internal or loopback addresses inside forwarding headers.

Detection Strategies

Inspect web server and WordPress access logs for API requests to the plugin routes carrying spoofed forwarding headers.
Alert on any HTTP response body containing signature strings such as PHP Version, phpinfo(), or Configuration File (php.ini) Path returned from public endpoints.
Correlate REMOTE_ADDR values with client-supplied X-Forwarded-For values and flag mismatches from untrusted sources.

Monitoring Recommendations

Enable WAF logging for all requests to /wp-json/ and plugin-specific routes, and retain header metadata for review.
Monitor for repeated requests from a single external IP that iterate through common loopback and RFC1918 values in forwarding headers.
Track outbound response sizes on plugin endpoints; unusually large responses may indicate phpinfo() disclosure.

How to Mitigate CVE-2025-12039

Immediate Actions Required

Update the BigBuy Dropshipping Connector for WooCommerce plugin to a version later than 2.0.5 once released by the vendor.
If no patched version is yet available, deactivate and remove the plugin until a fix is published.
Review web server logs for prior exploitation attempts and rotate any credentials, API keys, or secrets that may have been exposed via phpinfo() output.

Patch Information

At the time of NVD publication, refer to the Wordfence Vulnerability Analysis and the WordPress plugin repository for the latest fixed release. Apply the vendor-supplied update as soon as it becomes available.

Workarounds

Deploy a Web Application Firewall rule that strips or normalizes X-Forwarded-For, Client-IP, X-Real-IP, and Forwarded headers on requests from untrusted networks.
Configure the reverse proxy or load balancer to overwrite forwarding headers with the actual connecting IP before requests reach WordPress.
Restrict access to plugin API endpoints at the web server level using REMOTE_ADDR based rules rather than application-level header parsing.

bash

# Nginx example: overwrite client-supplied forwarding headers at the edge
location /wp-json/ {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Forwarded "";
    proxy_pass http://wordpress_backend;
}