CVE-2025-26730: Macro Calculator Information Disclosure Flaw

CVE-2025-26730 Overview

CVE-2025-26730 is an information disclosure vulnerability affecting the WordPress plugin Macro Calculator with Admin Email Optin & Data. The flaw is classified as Exposure of Sensitive System Information to an Unauthorized Control Sphere [CWE-497]. It impacts all plugin versions up to and including 1.0. Remote attackers can exploit the issue over the network without authentication or user interaction. The vulnerability allows unauthenticated retrieval of sensitive system information that should remain restricted to administrators.

Critical Impact

Unauthenticated remote attackers can retrieve sensitive system information from affected WordPress installations, enabling reconnaissance for follow-on attacks.

Affected Products

• WordPress plugin: Macro Calculator with Admin Email Optin & Data
• Affected versions: from n/a through 1.0
• Vendor identifier listed as NotFound in the upstream advisory

Discovery Timeline

• 2025-04-15 - CVE-2025-26730 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-26730

Vulnerability Analysis

The vulnerability is categorized under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The Macro Calculator with Admin Email Optin & Data plugin exposes system-level information through an interface accessible without authentication. Affected versions include all releases through 1.0. Confidentiality impact is high, while integrity and availability remain unaffected. The attack surface is network-reachable through the WordPress HTTP interface. The current EPSS probability is 0.307%.

Root Cause

The plugin fails to enforce access controls on functionality that returns sensitive system information. Output that should be restricted to authorized administrators is reachable by unauthenticated callers. The Patchstack advisory documents multiple issues in the plugin, with this entry tracking the sensitive information exposure path.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable plugin endpoint on a target WordPress site. No credentials, privileges, or user interaction are required. The response discloses sensitive system information that aids reconnaissance, fingerprinting, and chained exploitation of the host. See the Patchstack WordPress Vulnerability Report for technical details. No public proof-of-concept exploit is currently listed for this CVE.

Detection Methods for CVE-2025-26730

Indicators of Compromise

• Unauthenticated HTTP requests to plugin endpoints under /wp-content/plugins/macro-admin-email-data-optin-calculator/
• Responses returning configuration, environment, or debug data to unauthenticated callers
• Spikes in anonymous traffic targeting WordPress sites that have the affected plugin installed

Detection Strategies

• Inventory WordPress installations and identify any with the Macro Calculator with Admin Email Optin & Data plugin at version 1.0 or earlier
• Review web server access logs for unauthenticated requests to plugin-specific paths and AJAX actions
• Alert on outbound responses containing system metadata, file paths, or environment values served from plugin endpoints

Monitoring Recommendations

• Enable WordPress audit logging for plugin activity and unauthenticated requests
• Forward web access logs to a centralized analytics platform and apply rules for plugin endpoint abuse
• Track repeated anonymous requests against wp-admin/admin-ajax.php and plugin REST routes for reconnaissance patterns

How to Mitigate CVE-2025-26730

Immediate Actions Required

• Deactivate and remove the Macro Calculator with Admin Email Optin & Data plugin from any WordPress site running version 1.0 or earlier
• Restrict access to WordPress administrative and plugin endpoints using IP allowlists where feasible
• Rotate any administrative credentials, API keys, or secrets that may have been exposed through the plugin

Patch Information

No fixed version is identified in the available advisory data. The Patchstack record indicates the issue affects the plugin through version 1.0 with no published patched release. Until a maintained fix is available, removal of the plugin is the recommended remediation. Monitor the Patchstack WordPress Vulnerability Report for updates.

Workarounds

• Block external access to the plugin directory and AJAX actions at the web server or WAF layer
• Replace the plugin with a maintained alternative that enforces authentication on administrative functionality
• Apply virtual patching rules in front of WordPress to drop unauthenticated requests targeting the vulnerable endpoints