CVE-2025-2578 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) found in the Amelia Booking for Appointments and Events Calendar WordPress plugin. The flaw exists in the 'wpAmeliaApiCall' function, which improperly exposes the full filesystem path of the web application to unauthenticated users. This full path disclosure can provide attackers with valuable information about the server environment, directory structure, and deployment specifics, which can be leveraged to craft more effective attacks such as local file inclusion, directory traversal, or privilege escalation if other vulnerabilities are present. The vulnerability affects all versions up to and including 1.2.19. The CVSS 3.1 base score is 5.3, reflecting a medium severity due to the ease of exploitation (no authentication or user interaction required) but limited impact since the disclosed information alone does not allow direct compromise. No patches or fixes have been released at the time of publication, and no active exploitation has been reported. The vulnerability is primarily an information disclosure issue that serves as an enabler for more severe attacks rather than a direct threat by itself.

The primary impact of this vulnerability is the exposure of sensitive server path information to unauthenticated attackers. While this does not directly lead to data breaches or service disruption, it lowers the attacker's barrier to entry for subsequent attacks by revealing the underlying directory structure and potentially other environmental details. This can facilitate targeted exploitation of other vulnerabilities, increasing the overall risk to affected websites. Organizations relying on the Amelia Booking plugin may face increased risk of chained attacks, including remote code execution or data exfiltration if additional vulnerabilities exist. The impact is more pronounced for high-value targets such as e-commerce sites, healthcare providers, or any business relying on the plugin for appointment scheduling, where attackers could leverage this information to compromise customer data or disrupt services.

1. Monitor the official Amelia Booking plugin channels for security updates and apply patches promptly once available. 2. In the interim, restrict access to the 'wpAmeliaApiCall' endpoint using web application firewalls (WAFs) or server-level access controls to limit exposure to unauthenticated users. 3. Implement security best practices such as disabling directory listing and ensuring error messages do not leak sensitive information. 4. Conduct regular vulnerability assessments and penetration testing to identify and remediate other potential vulnerabilities that could be chained with this information disclosure. 5. Consider deploying runtime application self-protection (RASP) or intrusion detection systems to detect suspicious activities targeting the plugin. 6. Educate site administrators about the risks of using outdated plugins and the importance of timely updates.