CVE-2025-2840

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-284006.7An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit methodCVE-2025-284016.7An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameterCVE-2025-284029.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterCVE-2025-284037.2An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the reqCVE-2025-284059.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodCVE-2025-284069.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterCVE-2025-284078.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properCVE-2025-284089.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpCVE-2025-284098.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properCVE-2025-28415.3The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through thCVE-2025-284109.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whetheCVE-2025-284119.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
CVE-2025-2840: Medium severity, CVSS 5.3 | Vulnix