CVE-2025-12721: g-FFL Cockpit Information Disclosure Flaw

CVE-2025-12721 Overview

CVE-2025-12721 affects the g-FFL Cockpit plugin for WordPress in all versions up to and including 1.7.1. The plugin exposes a /server_status REST API endpoint without proper capability checks, allowing unauthenticated attackers to retrieve server information remotely. The flaw is classified under CWE-862: Missing Authorization and stems from an authorization gap in the endpoint registration logic.

Critical Impact

Unauthenticated attackers can query the plugin's REST API to obtain server status details, which can support reconnaissance for follow-on attacks against the host.

Affected Products

• WordPress plugin: g-FFL Cockpit
• Affected versions: all releases up to and including 1.7.1
• Fixed in the changeset published at revision 3413768

Discovery Timeline

• 2025-12-06 - CVE-2025-12721 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12721

Vulnerability Analysis

The g-FFL Cockpit plugin registers a REST API route at /server_status intended for administrative use. The route registration omits a permission_callback that verifies the caller's capability, so WordPress accepts requests from unauthenticated clients. When invoked, the endpoint returns server status details that can include PHP configuration, environment data, and plugin state.

Attackers can query the endpoint directly over HTTP without authentication. The disclosed information supports fingerprinting of the WordPress host and helps attackers identify additional weaknesses. See the Wordfence Vulnerability Report and the Personal Blog CVE Analysis for additional context.

Root Cause

The root cause is a missing authorization check on the REST route handler. The vulnerable registration in class-sync-endpoint.php does not enforce a capability verification before invoking the callback that returns server data. Review the WordPress Plugin Code Reference for the affected line.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP GET request to /wp-json/ followed by the plugin's /server_status route. No credentials, user interaction, or preconditions are required. A proof-of-concept is available in the GitHub PoC Repository.

Detection Methods for CVE-2025-12721

Indicators of Compromise

• Unauthenticated HTTP GET requests targeting the /wp-json/ path that reference the server_status route on WordPress hosts running g-FFL Cockpit
• Repeated REST API access from external IP addresses without an accompanying WordPress authentication cookie or nonce
• Access log entries returning HTTP 200 responses to /server_status requests originating from non-administrator sessions

Detection Strategies

• Inventory WordPress installations and identify sites running the g-FFL Cockpit plugin at versions at or below 1.7.1
• Review web server access logs for requests containing server_status and correlate with source IPs and user-agent strings
• Deploy a Web Application Firewall rule that blocks unauthenticated access to the vulnerable REST route until the plugin is patched

Monitoring Recommendations

• Forward WordPress access logs and PHP error logs to a centralized logging platform for query and correlation
• Alert on bursts of REST API requests to plugin endpoints from a single IP within a short interval
• Track outbound reconnaissance patterns from WordPress hosts following inbound /server_status requests

How to Mitigate CVE-2025-12721

Immediate Actions Required

• Update the g-FFL Cockpit plugin to a version above 1.7.1 that includes the fix from the plugin repository
• If an update is not immediately available, deactivate and remove the g-FFL Cockpit plugin from affected WordPress sites
• Restrict access to the /wp-json/ REST namespace at the reverse proxy or WAF layer until the patch is applied

Patch Information

The plugin maintainer published the fix in changeset 3413768. Details are available in the WordPress Change Log Entry. The patch adds a capability check to the REST route registration so only authorized users can invoke the server_status handler.

Workarounds

• Block unauthenticated requests to the plugin's REST route using a WAF rule that matches the server_status path
• Restrict WordPress REST API access by IP allowlist on administrative endpoints via web server configuration
• Disable the g-FFL Cockpit plugin until the upgrade is verified in a staging environment

# Example nginx rule to block unauthenticated access to the vulnerable route
location ~* /wp-json/.*/server_status {
    deny all;
    return 403;
}