CVE-2025-12721

MediumCVSS 5.3

Published: 06/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to Sensitive Information Exposure via the /server_status REST API endpoint due to a lack of capability checks. Unauthenticated attackers can extract information about the server.

Risk Assessment

Exposure of server information can aid attackers in further attacks, such as learning software versions or configuration details.

Recommendation

Update the g-FFL Cockpit plugin to the latest version. Consider restricting access to the /server_status endpoint or adding authentication.

Other vulnerabilities in g-FFL Cockpit

CVE-2025-12720Medium
The g-FFL Cockpit plugin for WordPress (versions up to and including 1.7.1) is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function. Unauthenticated attackers can delete arbitrary products.

Original NVD description (English source)

The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS