WordPress CVEs

Description

The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.

Affected WordPress components

• g-FFL Cockpit Plugin · g-ffl-cockpit
  Confirmed match Active
  Up to and including 1.7.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• garidium g-FFL Cockpit — Up to and including 1.7.1

References

• github.com https://github.com/d0n601/CVE-2025-12721
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/g-ffl-cockpit/trunk/includes/class-sync-endpoint.php#L1385
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3413768/
• ryankozak.com https://ryankozak.com/posts/cve-2025-12721/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd8c981-081c-4671-ad1e-3caf004669dd?source=cve
• nvd.nist.gov Official NVD record