CVE-2025-2883 describes a sensitive information exposure vulnerability in the Accept SagePay Payments Using Contact Form 7 WordPress plugin by zealopensource. The issue arises because a phpinfo.php script is publicly accessible, allowing unauthenticated attackers to retrieve potentially sensitive information about the server environment. This affects all versions up to and including 2.0. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with an attack vector of network, no privileges required, and no user interaction needed. No patch or official fix has been published as of the data provided.

An unauthenticated attacker can access the phpinfo.php script and obtain sensitive information about the server environment, which could aid in further attacks or reconnaissance. The exposure is limited to information disclosure without direct impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the phpinfo.php script by removing it or limiting access via web server configuration to trusted users only.