CVE-2025-31550: WP-LESS Information Disclosure Flaw

CVE-2025-31550 Overview

CVE-2025-31550 is a sensitive data exposure vulnerability in the WP-LESS WordPress plugin developed by thom4. The flaw affects all versions up to and including 1.9.6. It is classified under [CWE-538] as Insertion of Sensitive Information into an Externally-Accessible File or Directory. Unauthenticated attackers can retrieve embedded sensitive data by requesting exposed files directly over the network. The vulnerability requires no privileges and no user interaction, and its scope is changed, meaning impact can extend beyond the vulnerable component.

Critical Impact
Unauthenticated remote attackers can read sensitive data embedded in externally accessible files generated by WP-LESS on WordPress sites.

Affected Products

WP-LESS plugin for WordPress, versions up to and including 1.9.6
WordPress sites running the thom4 WP-LESS plugin
Any site exposing WP-LESS generated cache or compiled asset directories

Discovery Timeline

2025-04-01 - CVE-2025-31550 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-31550

Vulnerability Analysis

The WP-LESS plugin compiles LESS stylesheets into CSS for WordPress themes and plugins. During this process, the plugin writes generated files into a directory reachable through the web server. The vulnerability arises because these externally accessible files contain sensitive information that should not be exposed to unauthenticated visitors.

An attacker requests the exposed files directly over HTTP or HTTPS. No authentication, session, or user interaction is required. Because the scope is changed, disclosed data can influence resources beyond the plugin itself, such as revealing configuration details usable against the broader WordPress site.

The issue affects WP-LESS versions through 1.9.6. Refer to the Patchstack WordPress Vulnerability advisory for the technical writeup.

Root Cause

The root cause is the placement of files containing sensitive data into a directory served by the web server without adequate access controls. The plugin does not restrict direct HTTP access to compiled or cached artifacts, nor does it strip embedded sensitive content before writing them to disk. This maps to [CWE-538], Insertion of Sensitive Information into an Externally-Accessible File or Directory.

Attack Vector

The attack vector is network-based with low complexity. An unauthenticated attacker enumerates known WP-LESS output paths under the plugin or uploads directory of a target WordPress site. The attacker issues direct GET requests for cache files or compiled assets and parses their contents to extract embedded sensitive data. Automated scanning of WordPress sites at scale makes opportunistic exploitation practical, though no public exploit or CISA KEV listing is currently associated with this CVE.

Detection Methods for CVE-2025-31550

Indicators of Compromise

HTTP GET requests to WP-LESS cache or compiled asset paths from external IP addresses without a preceding page load referer
Repeated 200 responses for .css or cache files in plugin directories from scanners or unknown user agents
Access log entries showing directory enumeration attempts against /wp-content/ paths associated with WP-LESS

Detection Strategies

Review WordPress plugin inventories for WP-LESS installations at version 1.9.6 or earlier
Baseline expected access patterns for compiled CSS artifacts and alert on direct requests originating outside normal page rendering
Inspect WP-LESS output directories for files containing credentials, tokens, or internal paths that should not be web-accessible

Monitoring Recommendations

Aggregate web server access logs into a centralized analytics platform and flag unauthenticated access to plugin cache directories
Monitor for spikes in requests to .less, .css, or cache file paths from a single source over short intervals
Track WordPress plugin version drift with configuration management to identify unpatched WP-LESS deployments

How to Mitigate CVE-2025-31550

Immediate Actions Required

Identify all WordPress sites running WP-LESS and confirm the installed version
Remove or disable WP-LESS on any site running version 1.9.6 or earlier until a fixed release is confirmed
Restrict web server access to WP-LESS cache and compiled asset directories using server-level access controls
Rotate any credentials, API keys, or tokens that may have been embedded in exposed compiled output

Patch Information

At the time of publication, the vendor advisory tracked on Patchstack indicates the issue affects WP-LESS from an unspecified version through 1.9.6. Site administrators should monitor the plugin repository for an updated release addressing CVE-2025-31550 and apply it as soon as it becomes available.

Workarounds

Block direct HTTP access to WP-LESS output directories with web server rules that deny requests to cache paths
Deploy a web application firewall rule that denies unauthenticated requests to WP-LESS generated file paths
Relocate sensitive configuration outside of any files the plugin writes into web-accessible directories

bash

# Example Apache configuration to block direct access to WP-LESS cache directory
<DirectoryMatch "/wp-content/.*wp-less.*/cache/">
    Require all denied
</DirectoryMatch>