Critical · published November 11, 2025
🚨 Sensitive Information Exposure in the TNC Toolbox: Web Performance plugin for WordPress is a serious issue, allowing unauthorized access to your cPanel API credentials. 🔥 Think of it as leaving your house key under the welcome mat — anyone can pick it up! This plugin saves sensitive info like cPanel API credentials in plain sight, making it far too easy for bad actors to stroll right in. If an attacker gets hold of these credentials, they can infiltrate your cPanel, leading to arbitrary file uploads, remote code execution, and a full breach of your hosting environment. This isn’t just an inconvenience; it could result in total chaos for your website and data!
Think of it as leaving your house key under the welcome mat — anyone can pick it up! This plugin saves sensitive info like cPanel API credentials in plain sight, making it far too easy for bad actors to stroll right in. The vulnerability stems from the plugin's failure to securely store cPanel API credentials in the 'Tnc_Wp_Toolbox_Settings::save_settings' function, leaving them accessible in the web-accessible wp-content directory. Without proper protection, these sensitive files can easily be fetched by anyone without authentication.
If an attacker gets hold of these credentials, they can infiltrate your cPanel, leading to arbitrary file uploads, remote code execution, and a full breach of your hosting environment. This isn’t just an inconvenience; it could result in total chaos for your website and data! To protect yourself, update the plugin to version 1.4.3 immediately. Additionally, review your wp-content directory for any exposed credential files and secure them. Implement stricter permissions on sensitive files and consider using environment variables for storing credentials securely. You've got this! With these steps, you can secure your site and level up your security hero status! 🛡️