CVE-2025-6082: WordPress Birth Chart Full Path Disclosure

CVE-2025-6082 Overview

CVE-2025-6082 is an information disclosure vulnerability in the Birth Chart Compatibility plugin for WordPress. The flaw affects all versions up to and including 2.0. Unauthenticated attackers can directly access the plugin's index.php file, triggering a PHP error that leaks the full filesystem path of the web application.

The disclosed path is not directly harmful, but it provides reconnaissance data that assists in chaining with other vulnerabilities. The weakness is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated attackers can retrieve the absolute filesystem path of a WordPress installation, providing reconnaissance that enables follow-on exploitation such as local file inclusion or targeted payload delivery.

Affected Products

Birth Chart Compatibility plugin for WordPress — all versions through 2.0
WordPress sites with the plugin installed and publicly accessible
Any hosting environment where PHP error display is enabled for the plugin file

Discovery Timeline

2025-07-22 - CVE-2025-6082 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6082

Vulnerability Analysis

The Birth Chart Compatibility plugin exposes its index.php entry file to direct HTTP requests. When accessed outside the WordPress bootstrap context, the script references undefined WordPress functions and constants. PHP then emits a fatal error containing the absolute server path to the plugin file.

This category of flaw, known as Full Path Disclosure (FPD), is a reconnaissance-class vulnerability. It does not grant code execution or data modification on its own. Attackers combine the disclosed path with other issues such as Local File Inclusion, arbitrary file write, or log poisoning to escalate impact.

Root Cause

The root cause is the absence of an early-exit guard in the plugin's index.php. WordPress plugins typically prevent direct execution by checking for a defined constant such as ABSPATH and calling exit if it is missing. This plugin omits that check, allowing PHP to execute code that depends on WordPress core symbols, which then triggers an error that echoes the full server path.

Attack Vector

An unauthenticated remote attacker sends a direct HTTP GET request to the plugin file at /wp-content/plugins/birth-chart-compatibility/index.php. The server returns an error message containing the full absolute path, for example /var/www/html/wp-content/plugins/birth-chart-compatibility/index.php. No authentication, user interaction, or special headers are required.

The vulnerability requires PHP display_errors to be enabled, which is common on misconfigured production servers and default development stacks. See the WordPress Plugin Code Review for the affected source. Additional context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6082

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/birth-chart-compatibility/index.php from external IP addresses
HTTP 200 responses containing PHP error strings such as Fatal error, Call to undefined function, or absolute filesystem paths
Access log entries showing direct plugin file requests without a preceding WordPress page load

Detection Strategies

Inspect web server access logs for direct requests to plugin PHP files that bypass index.php at the WordPress root
Deploy a web application firewall rule that flags outbound responses containing PHP error signatures and absolute paths
Scan installed WordPress plugins for the Birth Chart Compatibility plugin at version 2.0 or earlier

Monitoring Recommendations

Alert on repeated unauthenticated requests probing /wp-content/plugins/*/index.php paths across the site
Monitor PHP error logs for Fatal error events originating from plugin directories
Track EPSS movement for this CVE — current EPSS is 1.567% at the 72nd percentile, indicating elevated scanning likelihood

How to Mitigate CVE-2025-6082

Immediate Actions Required

Disable or remove the Birth Chart Compatibility plugin until a patched version is confirmed available
Set display_errors = Off in php.ini on all production WordPress hosts to suppress path disclosure via any plugin
Restrict direct access to plugin PHP files through web server rules that block requests to wp-content/plugins/*/index.php

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version is listed for the Birth Chart Compatibility plugin. Administrators should monitor the WordPress Plugin Information page for an updated release and apply it immediately when published.

Workarounds

Add a top-of-file guard such as if ( ! defined( 'ABSPATH' ) ) { exit; } to the plugin index.php if patching in place
Deploy an .htaccess or Nginx location rule denying direct requests to the plugin directory
Route all WordPress traffic through a reverse proxy or WAF that strips PHP error content from HTTP responses

bash

# Nginx configuration to block direct access to the vulnerable plugin file
location ~* /wp-content/plugins/birth-chart-compatibility/index\.php$ {
    deny all;
    return 403;
}

# PHP hardening in php.ini
# display_errors = Off
# log_errors = On
# error_log = /var/log/php/error.log