CVE-2025-11379

22th percentile - higher than 22% of all known CVEs

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated attackers to extract configuration data.

An attacker can access configuration data, potentially leading to further attacks or disclosure of sensitive information. The risk is high as it does not require authentication.

Update the plugin to a version later than 0.25.9. Secure config files against direct access.