The g-FFL Cockpit plugin for WordPress allows unauthenticated callers to access the /server_status REST API endpoint without performing any capability checks. This omission leads to a Sensitive Information Exposure flaw, enabling attackers to obtain server‑level details such as operating system, PHP configuration, and possibly file paths. The weakness is identified as CWE‑862, a missing authorization issue, and results in confidentiality loss rather than code execution or denial of service.

The vulnerability affects the g‑FFL Cockpit plugin from garidium, affecting all installed releases up to and including version 1.7.1. The plugin is distributed as a WordPress plugin and relies on the WordPress REST API.

The CVSS score of 5.3 classifies the flaw as medium severity. With an EPSS score of less than 1 % and no listing in CISA KEV, the likelihood of real‑world exploitation is low, yet the impact on confidentiality can be significant if the server details are leveraged for further attacks. Attackers likely exploit the flaw by sending unauthenticated HTTP requests to the /server_status endpoint, requiring no special privileges or user interaction.