CVE-2025-11379: WebP Express <= 0.25.9 - Unauthenticated Information Exposure
The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated attackers to extract configuration data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11379?
CVE-2025-11379 is considered a medium severity vulnerability due to the risk of information exposure.
How do I fix CVE-2025-11379?
To fix CVE-2025-11379, update the WebP Express plugin to version 0.25.10 or later immediately.
What exploits are associated with CVE-2025-11379?
CVE-2025-11379 can be exploited to gain unauthorized access to sensitive configuration files on servers using NGINX.
Who is affected by CVE-2025-11379?
All users of the WebP Express plugin for WordPress versions up to and including 0.25.9 are affected by CVE-2025-11379.
What type of vulnerability is CVE-2025-11379?
CVE-2025-11379 is classified as an information exposure vulnerability due to improper file name randomization.