What’s Vulnerable › Vulnerabilities

CVE-2025-12721: g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-06 · updated 2026-10-15
• Weakness: CWE-862

Description

The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.

Affected products

• garidium g-FFL Cockpit: through 1.7.1

References

• https://github.com/d0n601/CVE-2025-12721
• https://plugins.trac.wordpress.org/browser/g-ffl-cockpit/trunk/includes/class-sync-endpoint.php#L1385
• https://plugins.trac.wordpress.org/changeset/3413768/
• https://ryankozak.com/posts/cve-2025-12721/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd8c981-081c-4671-ad1e-3caf004669dd?source=cve

Get alerted when CVE-2025-12721 or the next vulnerability affects your stack