What is CVE-2025-12039?

CVE-2025-12039 is a medium-severity vulnerability in Devsmip Bigbuy Dropshipping Connector For Woocommerce, classified under Information Disclosure. CVSS score: 5.3/10. Published 2025-11-21.

How severe is CVE-2025-12039?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Devsmip Bigbuy Dropshipping Connector For Woocommerce

CVE-2025-12039

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().

Vulnerability class: Information Disclosure

EPSS: 0.003 (20.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Devsmip Bigbuy Dropshipping Connector For Woocommerce — versions 0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

Frequently asked questions

What is CVE-2025-12039?: CVE-2025-12039 is a medium-severity vulnerability in Devsmip Bigbuy Dropshipping Connector For Woocommerce, classified under Information Disclosure. CVSS score: 5.3/10. Published 2025-11-21.
How severe is CVE-2025-12039?: Medium severity. CVSS v3 base score is 5.3 out of 10.