CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
AnalysisAI
Unauthenticated attackers can access sensitive information through publicly exposed log files in the Content Writer WordPress plugin versions up to 3.6.8. The plugin fails to properly restrict access to log files, allowing remote attackers without authentication or user interaction to view potentially sensitive data stored in these logs. This vulnerability carries a moderate CVSS score of 5.3 with confirmed public information disclosure impact.
Technical ContextAI
The vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), where the Content Writer plugin for WordPress creates or maintains log files that are accessible to unauthenticated users via direct web requests. WordPress plugins typically store log files in predictable directories (such as /wp-content/plugins/content-writer/logs/ or similar), and improper file permissions or lack of access controls allow these files to be retrieved by any remote attacker. The plugin likely logs debugging information, database queries, configuration details, or user data without implementing adequate authentication checks or HTTP access restrictions (e.g., .htaccess rules, HTTP header controls, or backend authentication gates) to protect these logs from public enumeration and download.
Affected ProductsAI
The Content Writer WordPress plugin is affected in all versions up to and including 3.6.8. The plugin is hosted at https://wordpress.org/plugins/content-writer/ and is distributed through the official WordPress plugin repository. The vulnerability impacts any WordPress installation with this plugin active on versions 3.6.8 or earlier.
RemediationAI
WordPress site administrators should immediately update the Content Writer plugin to a version newer than 3.6.8, which should implement proper access controls to restrict log file visibility. Additionally, administrators should manually restrict access to log files by implementing HTTP authentication, denying direct web access via .htaccess rules (e.g., placing a deny-all directive in the plugin's log directory), or reviewing and deleting existing exposed log files that may contain sensitive information. For detailed patch availability and upgrade instructions, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bb20452b-7049-4567-8288-6d24350e2143?source=cve and the WordPress plugin update interface.
Share
External POC / Exploit Code
Leaving vuln.today