CVE-2025-2840 affects the DAP to Autoresponders Email Syncing plugin for WordPress, allowing unauthenticated remote attackers to access sensitive information through a publicly accessible phpinfo.php script. This exposure occurs in all versions up to and including 1.0. The vulnerability is categorized under CWE-200, indicating an information exposure issue. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to partial information disclosure. No patch or official fix has been documented, and the product is not a cloud service, so remediation depends on vendor updates or manual mitigation.

An unauthenticated attacker can access the phpinfo.php script publicly exposed by the plugin, potentially revealing sensitive server and environment information. This exposure could aid attackers in further attacks but does not directly impact integrity or availability. The confidentiality impact is limited but non-negligible due to the nature of the information disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider removing or restricting access to the phpinfo.php script to prevent unauthorized information disclosure. No official patch or temporary fix is currently documented.