漏洞关键信息 CVE ID: WebP Express <= 0.25.9 - Unauthenticated Information Exposure CVSS Score: 5.3 (Medium) Publicly Published: December 3, 2025 Last Updated: December 4, 2025 Researcher: Rafshanzani Suhada Software Type: Plugin Software Slug: webp-express (view on wordpress.org) Patched?: No Remediation: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. Affected Version: <= 0.25.9 描述 The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly securing these files, allowing unauthorized users to access sensitive information.