CVE-2025-2841: Cart66 Cloud Information Disclosure Flaw

CVE-2025-2841 Overview

CVE-2025-2841 affects the Cart66 Cloud plugin for WordPress in all versions up to and including 2.3.7. The plugin ships with a publicly accessible phpinfo.php script that exposes the output of PHP's phpinfo() function without authentication. Unauthenticated remote attackers can retrieve server configuration details, loaded modules, environment variables, and other sensitive runtime information by requesting the script directly. The issue is categorized as an Information Exposure weakness under [CWE-200]. This exposed data can support reconnaissance for follow-on attacks against the WordPress site and its underlying hosting environment.

Critical Impact
Unauthenticated attackers can retrieve PHP configuration and environment details from any WordPress site running Cart66 Cloud ≤ 2.3.7, enabling reconnaissance for further compromise.

Affected Products

Cart66 Cloud plugin for WordPress — all versions ≤ 2.3.7
WordPress sites exposing phpinfo.php from the plugin's admin views directory
PHP environments where server configuration is disclosed via the plugin

Discovery Timeline

2025-04-12 - CVE-2025-2841 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2841

Vulnerability Analysis

The Cart66 Cloud plugin includes a system information view intended for administrators to diagnose server configuration. The plugin's views/admin/html-system-info.php template references a phpinfo.php script that is reachable directly over HTTP without any authentication or capability check. When requested, the script invokes PHP's phpinfo() function and returns the full report to the client.

The phpinfo() output typically discloses the PHP version, loaded extensions, compiled-in modules, php.ini settings, server API type, environment variables, absolute filesystem paths, and HTTP request headers. Attackers use this data to fingerprint the stack, identify vulnerable PHP or extension versions, locate writable paths, and craft targeted exploits. Because the endpoint is unauthenticated and reachable over the network, mass scanning against WordPress installations is trivial.

Root Cause

The root cause is a diagnostic script committed to the plugin's public web root without an authorization gate. The plugin does not verify current_user_can(), does not require a nonce, and does not block direct file access via ABSPATH checks. Any HTTP client that knows the plugin path can invoke the script and receive phpinfo() output.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues an HTTP GET request to the plugin's phpinfo.php under /wp-content/plugins/cart66-cloud/. No credentials, cookies, or user interaction are needed. The response body contains the full phpinfo() HTML report, which the attacker parses to enumerate the target environment.

See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the affected code locations.

Detection Methods for CVE-2025-2841

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/cart66-cloud/phpinfo.php or paths containing html-system-info.php
Response bodies containing the string phpinfo() or PHP Version returned from plugin paths
Repeated unauthenticated 200-status responses to plugin diagnostic scripts from a single source IP
Requests originating from known vulnerability scanners (e.g., user-agents matching wpscan, nuclei, masscan)

Detection Strategies

Review web server access logs for any request path matching cart66-cloud/phpinfo.php and flag unauthenticated hits
Deploy a web application firewall (WAF) rule that alerts when responses from /wp-content/plugins/ include phpinfo output signatures
Run authenticated vulnerability scans against WordPress hosts to detect Cart66 Cloud versions ≤ 2.3.7

Monitoring Recommendations

Correlate scanner activity targeting the vulnerable path with subsequent authentication attempts against wp-login.php
Track outbound reconnaissance patterns following successful information disclosure retrievals
Alert on any HTTP 200 response larger than a defined threshold served from plugin directories to anonymous clients

How to Mitigate CVE-2025-2841

Immediate Actions Required

Remove or restrict access to the phpinfo.php file within the Cart66 Cloud plugin directory
Block requests to /wp-content/plugins/cart66-cloud/phpinfo.php at the WAF or reverse proxy layer
Deactivate the Cart66 Cloud plugin until a patched release is installed if the diagnostic file cannot be removed safely
Rotate any credentials, API keys, or secrets that may have been present in server environment variables exposed by phpinfo()

Patch Information

At the time of the NVD entry, all versions up to and including 2.3.7 are affected. Administrators should monitor the WordPress Plugin Developer page for a fixed release and update to a version above 2.3.7 as soon as it becomes available.

Workarounds

Delete the phpinfo.php file from wp-content/plugins/cart66-cloud/ on the filesystem
Add a web server rule (Apache .htaccess or nginx location block) that denies direct access to .php files under the plugin's views/admin/ directory
Disable the phpinfo function in php.ini via disable_functions = phpinfo to neutralize exposure across all applications on the host

bash

# nginx example: block direct access to the vulnerable script
location ~* /wp-content/plugins/cart66-cloud/phpinfo\.php$ {
    deny all;
    return 403;
}

# php.ini hardening: disable phpinfo globally
# disable_functions = phpinfo