The DAP to Autoresponders Email Syncing plugin for WordPress contains a publicly accessible phpinfo.php script that reveals configuration details and other sensitive data. Because the file is reachable without authentication, an attacker can obtain server environment variables, database credentials, and other secrets, resulting in a loss of confidentiality. This weakness is classified as CWE-200.

The vulnerability affects all releases of the DAP to Autoresponders Email Syncing plugin up to and including version 1.0, as provided by the vendor bhuvnesh. No further version information is available, so any installation using version 1.0 or earlier is potentially exposed.

The CVSS score of 5.3 indicates a moderate impact, but the EPSS score of < 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by simply accessing the phpinfo.php file via any web browser, as the script is unauthenticated and directly served by WordPress. The attack requires no special privileges and thus poses a straightforward risk to any site hosting the affected plugin.