CVE-2025-2840: WordPress DAP Plugin Info Disclosure Flaw

CVE-2025-2840 Overview

CVE-2025-2840 affects the DAP to Autoresponders Email Syncing plugin for WordPress in all versions up to and including 1.0. The plugin ships a publicly accessible phpinfo.php script that exposes PHP environment configuration data. Unauthenticated remote attackers can request this script over the network and read potentially sensitive server information. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can retrieve PHP configuration details, environment variables, module lists, and file paths that support reconnaissance for follow-on attacks against the WordPress host.

Affected Products

WordPress plugin: DAP to Autoresponders Email Syncing (dap-to-autoresponders-daar)
Affected versions: all releases up to and including 1.0
Vulnerable component: infusionsoft_src/phpinfo.php

Discovery Timeline

2025-03-29 - CVE-2025-2840 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2840

Vulnerability Analysis

The plugin bundles a diagnostic script, phpinfo.php, inside the infusionsoft_src/ directory. The script invokes PHP's phpinfo() function and is reachable directly through the web server without authentication. Any visitor who knows or guesses the plugin path can render the full PHP configuration page.

The phpinfo() output reveals PHP version, loaded extensions, environment variables, SERVER variables, absolute filesystem paths, and configuration directives. Attackers use this data to fingerprint the platform, identify outdated PHP components, and craft targeted exploits against other services on the same host.

The issue is a classic information disclosure flaw rather than a code execution defect. It does not modify data or degrade availability, but it lowers the cost of reconnaissance for adversaries preparing more damaging follow-on activity.

Root Cause

The plugin author left a debug artifact in the shipped distribution. The phpinfo.php file contains an unauthenticated call to phpinfo() and has no access control, .htaccess restriction, or capability check gating it. Any request to the plugin's static path returns the full report.

Attack Vector

Exploitation requires only an HTTP GET request to the plugin's phpinfo.php URL, for example /wp-content/plugins/dap-to-autoresponders-daar/infusionsoft_src/phpinfo.php. No credentials, session, or user interaction are needed. Attackers commonly scan WordPress installations for known plugin paths and harvest phpinfo() output at scale.

See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the vulnerable file reference.

Detection Methods for CVE-2025-2840

Indicators of Compromise

HTTP requests to URLs containing /dap-to-autoresponders-daar/infusionsoft_src/phpinfo.php
Successful 200 OK responses to unauthenticated phpinfo.php requests in web server access logs
Reconnaissance patterns from a single source enumerating WordPress plugin directories

Detection Strategies

Search web server access logs for any request path ending in phpinfo.php under wp-content/plugins/.
Alert on response bodies containing the strings phpinfo(), PHP Version, or System => Linux served from plugin directories.
Use WordPress vulnerability scanners such as Wordfence or WPScan to flag the plugin version 1.0 and earlier.

Monitoring Recommendations

Forward Apache or Nginx access logs to a centralized log platform and build a rule for unauthenticated PHP diagnostic endpoints.
Track outbound requests from reconnaissance IP ranges hitting multiple plugin paths in short intervals.
Review installed WordPress plugins periodically and inventory any file matching phpinfo*.php across web roots.

How to Mitigate CVE-2025-2840

Immediate Actions Required

Delete or rename wp-content/plugins/dap-to-autoresponders-daar/infusionsoft_src/phpinfo.php on affected hosts.
Deactivate and remove the DAP to Autoresponders Email Syncing plugin if a patched release is not available.
Rotate any credentials, API keys, or secrets that appeared in environment variables exposed by phpinfo().

Patch Information

At the time of the last NVD update, no fixed version is listed for the DAP to Autoresponders Email Syncing plugin. Monitor the WordPress Plugin Developer Info page for a corrected release and apply it once published.

Workarounds

Block access to the phpinfo.php file at the web server layer using an Nginx location deny rule or Apache <Files> directive.
Add a WAF rule that returns 403 for any request path matching phpinfo\.php under wp-content/.
Restrict access to the entire plugin directory to internal IP ranges until removal or patching is complete.

bash

# Apache: deny public access to the exposed diagnostic script
<Files "phpinfo.php">
    Require all denied
</Files>

# Nginx: block requests to phpinfo.php under any plugin path
location ~* /wp-content/plugins/.*/phpinfo\.php$ {
    deny all;
    return 403;
}