CVE-2025-23969: KI Live Video Conferences Info Disclosure

CVE-2025-23969 Overview

CVE-2025-23969 is a sensitive data exposure vulnerability affecting the KI Live Video Conferences WordPress plugin developed by whassan. The flaw is categorized under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. It allows unauthenticated attackers to retrieve embedded sensitive data from vulnerable installations over the network. All plugin versions up to and including 5.5.15 are affected. The issue carries a CVSS 3.1 base score of 5.3 and an EPSS probability of 0.306%.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive data from affected WordPress sites, potentially exposing configuration information useful for follow-on attacks.

Affected Products

whassan KI Live Video Conferences (ki-live-video-conferences) plugin for WordPress
All versions from n/a through 5.5.15
WordPress sites with the plugin installed and active

Discovery Timeline

2025-06-06 - CVE-2025-23969 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23969

Vulnerability Analysis

The vulnerability stems from the plugin exposing sensitive system information to an unauthorized control sphere. An unauthenticated remote attacker can issue requests to the vulnerable WordPress instance and retrieve embedded sensitive data that should not be reachable from an untrusted network context. The confidentiality impact is limited to information disclosure, with no direct effect on integrity or availability of the host system.

The weakness classification [CWE-497] describes conditions where an application places sensitive data such as configuration values, credentials, internal paths, or debug information within resources accessible to actors outside the intended trust boundary. In this WordPress plugin, that boundary is crossed by network-reachable endpoints or embedded resources that respond without authentication.

Root Cause

The root cause is improper isolation of sensitive data within plugin resources. Files, endpoints, or responses served by ki-live-video-conferences versions up to 5.5.15 contain data that should be scoped to authenticated administrators or kept server-side only. The plugin does not enforce authentication or authorization checks before returning this content.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker enumerates WordPress sites running the affected plugin, then requests the exposed resource to harvest sensitive data. Retrieved information can support reconnaissance, credential compilation, or chained attacks against the WordPress instance and its integrations. Technical exploitation details are documented in the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2025-23969

Indicators of Compromise

Unauthenticated HTTP GET requests targeting paths under /wp-content/plugins/ki-live-video-conferences/ from external IP addresses
Repeated access to plugin resource files from scanning tools or unusual user agents
Outbound reconnaissance patterns following requests to plugin endpoints

Detection Strategies

Inventory WordPress installations and identify sites running ki-live-video-conferences version 5.5.15 or earlier
Review web server access logs for anonymous requests to plugin paths and correlate with source reputation
Deploy a Web Application Firewall (WAF) rule that alerts on access to plugin files known to expose sensitive data

Monitoring Recommendations

Enable verbose access logging on the WordPress reverse proxy or web server for all /wp-content/plugins/ traffic
Alert on spikes in 200 OK responses to unauthenticated plugin endpoints
Track outbound use of any credentials or tokens that may have been embedded in plugin resources

How to Mitigate CVE-2025-23969

Immediate Actions Required

Identify all WordPress sites running ki-live-video-conferences and confirm the installed version
Deactivate the plugin until a patched release is confirmed installed, if the plugin is not business-critical
Rotate any credentials, API keys, or tokens that may have been embedded in plugin files or configuration

Patch Information

At time of publication, the Patchstack advisory lists the vulnerability as affecting versions up to and including 5.5.15. Administrators should monitor the WordPress plugin repository and the vendor for a fixed release, then upgrade all instances once available. Verify the fix by confirming the previously accessible endpoint returns an authentication error or 404 response.

Workarounds

Restrict access to plugin files at the web server level using directives that deny direct requests to sensitive paths under /wp-content/plugins/ki-live-video-conferences/
Place the WordPress admin and plugin endpoints behind an authenticated reverse proxy or IP allowlist
Remove the plugin entirely if live video conferencing functionality is not required

bash

# Example nginx configuration to block direct access to plugin resource files
location ~* /wp-content/plugins/ki-live-video-conferences/.*\.(php|inc|log|txt|json|env)$ {
    deny all;
    return 403;
}