CVE-2025-12039 is a medium severity vulnerability in the BigBuy Dropshipping Connector for WooCommerce plugin caused by insufficient validation of IP addresses. The plugin relies on user-supplied HTTP headers to determine the client's IP address, which can be spoofed by unauthenticated attackers. This flaw enables attackers to retrieve the output of the phpinfo() function, potentially exposing sensitive server configuration details. The vulnerability affects all versions up to and including 2.0.5. No patch or official remediation has been published yet.

An unauthenticated attacker can exploit this vulnerability to obtain sensitive server information via phpinfo() output. This exposure could aid attackers in further reconnaissance or targeted attacks but does not directly allow code execution or data modification. The impact is limited to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin or disabling it if possible to prevent unauthorized information disclosure.