CVE-2025-6722 is a sensitive information exposure vulnerability in the BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security WordPress plugin (versions up to 4.5). The plugin automatically creates a bitfire_* directory that contains sensitive files without proper access controls. When directory listing is enabled on the hosting server and the standard index.php file in the plugin directory is missing or ignored, unauthenticated attackers can retrieve sensitive files like config.ini and debug.log. This exposure can lead to unauthorized disclosure of configuration and debugging information.

An unauthenticated attacker can access sensitive files stored in the bitfire_* directory if directory listing is enabled and the index.php file is missing or ignored. This can lead to disclosure of configuration details and debugging information, potentially aiding further attacks. The vulnerability does not allow modification or denial of service but compromises confidentiality to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure directory listing is disabled on their web servers and verify that the ~/wp-content/plugins/index.php file exists and is properly served to prevent directory contents from being listed. Monitoring and restricting access to the bitfire_* directory can also reduce exposure.