CVE-2025-2883: WordPress SagePay Plugin Info Disclosure

CVE-2025-2883 Overview

CVE-2025-2883 is an information disclosure vulnerability in the Accept SagePay Payments Using Contact Form 7 plugin for WordPress. The flaw affects all versions up to and including 2.0. It stems from a publicly accessible phpinfo.php script bundled with the plugin. Unauthenticated attackers can request this script directly over the network to view PHP environment details, server configuration, loaded modules, and other potentially sensitive information. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. While the vulnerability does not allow direct code execution, the exposed data supports reconnaissance for follow-on attacks against the WordPress host.

Critical Impact
Unauthenticated remote attackers can retrieve PHP configuration data that aids in identifying additional attack surface on affected WordPress installations.

Affected Products

Accept SagePay Payments Using Contact Form 7 WordPress plugin, versions up to and including 2.0
WordPress installations with the vulnerable plugin activated
Web servers exposing the plugin's cfspzw-info.php script path

Discovery Timeline

2025-04-08 - CVE-2025-2883 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2883

Vulnerability Analysis

The plugin ships a diagnostic PHP file that calls phpinfo() without any access control. The file resides at inc/front/template/cfspzw-info.php within the plugin directory. Any client that can reach the WordPress site can request the file directly through its predictable URL. The server responds with the complete phpinfo() output. This output enumerates PHP version, compiled modules, php.ini directives, environment variables, server paths, and loaded extensions. Attackers use this data to fingerprint the stack and select targeted exploits for known PHP or module weaknesses.

Root Cause

The root cause is inclusion of a debug script in the production plugin distribution without authentication or capability checks. The script executes phpinfo() on any GET request. WordPress does not gate direct requests to plugin PHP files, so the diagnostic endpoint is reachable without a valid session. The vendor addressed the issue in changeset 3266837 by removing or restricting the file. See the vulnerable file reference for the pre-patch source.

Attack Vector

Exploitation requires only an HTTP GET request to the plugin's diagnostic path, for example /wp-content/plugins/accept-sagepay-payments-using-contact-form-7/inc/front/template/cfspzw-info.php. No authentication, cookies, or user interaction is required. The response body contains the full phpinfo() page. Attackers commonly script this request across large ranges of WordPress hosts to harvest environment data. The EPSS probability is 0.386% at the 30.9 percentile as of 2026-07-21, reflecting low observed exploitation activity but trivial exploitation mechanics.

No verified proof-of-concept code is published. The vulnerability is exercised through a direct HTTP request to the exposed script and does not require a custom payload.

Detection Methods for CVE-2025-2883

Indicators of Compromise

HTTP GET requests to URLs containing cfspzw-info.php or the plugin path accept-sagepay-payments-using-contact-form-7/inc/front/template/
Web server 200 responses to unauthenticated requests for plugin PHP files that return phpinfo() output
Repeated access to plugin directory paths from a single source IP within a short interval, indicating scanning behavior

Detection Strategies

Search web server access logs for any request URI matching the vulnerable script path, regardless of response code
Alert on HTTP responses whose body contains phpinfo() markers such as PHP Version => served from /wp-content/plugins/ paths
Correlate plugin path requests with subsequent probing of admin endpoints or authentication attempts against the same host

Monitoring Recommendations

Enable verbose access logging on WordPress web servers and forward logs to a centralized analytics platform for retention and search
Track the installed plugin inventory and version across WordPress fleets to identify hosts running vulnerable releases
Monitor outbound reconnaissance patterns from the WordPress host that follow successful phpinfo disclosure, since exposed paths often precede exploitation

How to Mitigate CVE-2025-2883

Immediate Actions Required

Update the Accept SagePay Payments Using Contact Form 7 plugin to a version later than 2.0 that includes changeset 3266837
Manually delete inc/front/template/cfspzw-info.php from the plugin directory if an immediate update is not possible
Confirm that the diagnostic URL returns HTTP 404 after remediation

Patch Information

The vendor released a fix through the WordPress plugin repository. Review the WordPress plugin developer page for the latest release. Additional detail is documented in the Wordfence vulnerability report.

Workarounds

Block requests to the vulnerable path at the web application firewall or reverse proxy layer until the plugin is updated
Disable direct PHP execution inside wp-content/plugins/ subdirectories that do not require it, using web server configuration rules
Set expose_php = Off and restrict phpinfo() disclosure globally in php.ini to reduce the value of any accidental exposure

bash

# Nginx location block to deny access to the vulnerable script
location ~* /wp-content/plugins/accept-sagepay-payments-using-contact-form-7/inc/front/template/cfspzw-info\.php$ {
    deny all;
    return 404;
}