CVE-2025-2881 affects the bap22 Developer Toolbar WordPress plugin, specifically versions up to and including 1.0.3. The vulnerability arises from a publicly accessible phpinfo.php script that exposes sensitive information to unauthenticated users. This exposure can reveal configuration details or environment information that could aid attackers in further attacks. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss.

An unauthenticated attacker can access the phpinfo.php script and obtain sensitive information about the server environment and configuration. This information disclosure does not directly impact integrity or availability but can facilitate further attacks by providing attackers with valuable reconnaissance data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the phpinfo.php script by removing it or limiting access through web server configuration or access controls to prevent unauthorized exposure.