CVE-2025-11379 is an information exposure vulnerability (CWE-200) in the WebP Express plugin for WordPress by roselldk. The issue arises from the plugin's failure to randomize the config file names properly, allowing unauthenticated attackers to directly access these files on NGINX web servers. This exposure can reveal sensitive configuration data. The vulnerability affects all versions up to and including 0.25.9. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact only. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can access sensitive configuration files of the WebP Express plugin on affected WordPress sites running NGINX, potentially disclosing configuration data. The impact is limited to confidentiality; integrity and availability are not affected. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting direct access to plugin configuration files via web server configuration (e.g., NGINX rules) to prevent unauthorized access.