What is the CVSS score of CVE-2025-62955?

CVE-2025-62955 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62955

Q: Which versions of Wordpress Plugin are affected by CVE-2025-62955?

HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1.

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-12-21 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 21, 2025 - 21:15 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through <= 1.3.1.

AnalysisAI

HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.

Technical ContextAI

This vulnerability stems from CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), which describes cases where sensitive data intended for privileged users is accessible to unauthorized parties due to insufficient access controls. The HappyDevs TempTool WordPress plugin, specifically its [Show Current Template Info] feature, fails to properly restrict access to template metadata and system information. The plugin likely exposes configuration details, template names, or server environment data through inadequate permission checks or direct information leakage in plugin outputs, allowing unauthenticated or low-privileged users to enumerate system details.

Affected ProductsAI

HappyDevs TempTool WordPress plugin versions 1.3.1 and earlier are affected. The plugin is identified through the CPE context as a WordPress plugin offering template information display functionality. Detailed version ranges below 1.3.1 are not specified in available data, but the vendor advisory at patchstack.com/database indicates the entire released version history up to and including 1.3.1 is vulnerable.

RemediationAI

Update HappyDevs TempTool to the latest patched version above 1.3.1 immediately. No specific fixed version is confirmed in the provided data; consult the vendor's WordPress.org plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/current-template-name/vulnerability/wordpress-temptool-show-current-template-info-plugin-1-3-1-sensitive-data-exposure-vulnerability?_s_id=cve for the exact patched release. If immediate patching is unavailable, consider disabling the [Show Current Template Info] feature or restricting plugin functionality through access controls until an update is released. Review server access logs to determine if the vulnerability has been exploited in your environment.