CVE-2025-11379

Executive Summary

CVE-2025-11379 is a medium-severity information disclosure vulnerability affecting the WebP Express WordPress plugin, versions up to and including 0.25.9. The flaw allows unauthenticated attackers to access configuration files on servers running NGINX due to insufficient randomization of the config file name. This exposure can leak sensitive configuration data, potentially aiding further attacks. The vulnerability has a CVSS score of 5.3, indicating moderate risk, and no public proof-of-concept or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The issue lies in how the plugin handles config file naming on NGINX-based servers, not in the web server software itself. Administrators using NGINX with this plugin are at risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. While the direct impact is limited to information disclosure, leaked configuration data (e.g., API keys, database credentials) could enable more severe attacks.

Deep Dive & Mechanics

The WebP Express plugin generates configuration files to manage image conversion settings. On NGINX servers, these files are stored in a predictable location (e.g., wp-content/webp-express/config/). The plugin fails to randomize the filename, allowing attackers to guess or enumerate the config file path. By sending a direct HTTP request to the config file, an unauthenticated attacker can retrieve sensitive data such as:

• Server paths and directory structures
• API keys for image optimization services
• Database connection strings (if stored in config)
• Plugin-specific settings

The vulnerability is exclusive to NGINX because Apache typically blocks direct access to .php or .json files in such directories via .htaccess rules, which NGINX does not natively support.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.25.9): The plugin likely uses a static or predictable filename for the config file, such as config.json or config-1.json, stored in a publicly accessible directory.

// Example vulnerable pattern
$config_file = WP_CONTENT_DIR . '/webp-express/config/config.json';

Patched Code (Hypothetical): A fix would involve generating a random, non-guessable filename and storing it outside the web root or using server-specific access controls.

// Example patched pattern
$config_file = WP_CONTENT_DIR . '/webp-express/config/config-' . wp_generate_password(32, false) . '.json';

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Reconnaissance: Identify WordPress sites using the WebP Express plugin via Shodan or Google dorks.
2. Enumerate Config Files: Attempt to access common config file paths:
   • https://target.com/wp-content/webp-express/config/config.json
   • https://target.com/wp-content/webp-express/config/config-1.json
   • https://target.com/wp-content/webp-express/config/config-2.json
3. Extract Data: If successful, parse the JSON output for sensitive information.

Example curl command:

curl -s https://target.com/wp-content/webp-express/config/config.json | jq .

Blue Team (Defense & Detection)

1. Monitor Access Logs: Look for repeated requests to /wp-content/webp-express/config/ paths.
2. Implement WAF Rules: Block direct access to the config directory.
3. Harden NGINX: Add explicit deny rules in the server block:

location ~ ^/wp-content/webp-express/config/ {
    deny all;
    return 403;
}

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/webp-express/config/config.json
  • /wp-content/webp-express/config/config-*.json
• HTTP Requests:
  • GET /wp-content/webp-express/config/config.json
  • GET /wp-content/webp-express/config/config-1.json
• Response Patterns:
  • HTTP 200 with JSON content containing "api_key", "db_password", or similar keys.
• User-Agent: Any standard browser or curl user-agent.

Detection Engineering

YARA Rule

rule detect_webp_express_config_exposure {
    meta:
        description = "Detects WebP Express config file exposure attempts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-11379"
    strings:
        $config_path = /\/wp-content\/webp-express\/config\/config[-0-9]*\.json/
        $config_content = /"api_key"|"db_password"|"secret"/
    condition:
        $config_path or $config_content
}

Sigma Rule

title: WebP Express Config File Access
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to access WebP Express config files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-stem|contains: 
            - '/wp-content/webp-express/config/config.json'
            - '/wp-content/webp-express/config/config-'
    condition: selection
falsepositives:
    - Legitimate plugin updates
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11379 WebP Express Config File Access";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-content/webp-express/config/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Manually restrict access to the config directory via NGINX configuration:

   location ~ ^/wp-content/webp-express/config/ {
       deny all;
       return 403;
   }
   

2. Plugin Update: Monitor the WebP Express plugin page for a patched version. If unavailable, consider disabling the plugin until a fix is released.
3. Web Application Firewall (WAF): Deploy rules to block requests matching the config file pattern.
4. File Permissions: Ensure config files are not world-readable (chmod 600 or 640).
5. Regular Audits: Scan for exposed config files using the provided YARA rule.

Valters IT