The TNC Toolbox: Web Performance plugin for WordPress stores cPanel API credentials in plain text files inside the web‑accessible wp-content directory, a flaw that allows attackers to read those files without authentication. With access to the hostname, username, and API key, an adversary can call the cPanel API and perform operations such as arbitrary file uploads, remote code execution, and complete takeover of the hosting account. The weakness is a sensitive information exposure in the settings persistence layer, classified as CWE-922.

WordPress sites running the TNC Toolbox: Web Performance plugin version 1.4.2 or earlier are affected. The plugin is distributed by leopardhost under the product name TNC Toolbox: Web Performance. No further version information is available in the CVE data, so any site still on these releases is vulnerable.

The vulnerability carries a CVSS score of 10, indicating critical severity. The EPSS score is reported as less than 1%, meaning the public exploitation probability is low at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated read access to files in wp-content, allowing the attacker to retrieve the unprotected credentials. Once those credentials are obtained, exploitation of the cPanel API grants full control over the hosting environment.