The vulnerability is a publicly accessible phpinfo.php script in the Developer Toolbar plugin for WordPress that allows anyone to retrieve detailed PHP environment information without authentication. This leads to sensitive information exposure such as configuration settings, database credentials, and potential server secrets, representing a CWE‑200 weakness.

Any WordPress site running the Developer Toolbar plugin at version 1.0.3 or earlier. The plugin is distributed by the vendor bap22 and is available through the WordPress plugin repository.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% shows a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. An attacker can perform the exploit simply by requesting the phpinfo.php endpoint via HTTP, with no authentication required, thereby gaining access to confidential PHP configuration information. The impact is primarily confidentiality loss; there is no evidence of code execution or denial of service from this flaw.