What is the CVSS score of CVE-2025-10486?

CVE-2025-10486 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-10486

MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2025-10-15 security@wordfence.com

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Oct 15, 2025 - 09:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

AnalysisAI

Unauthenticated attackers can access sensitive information through publicly exposed log files in the Content Writer WordPress plugin versions up to 3.6.8. The plugin fails to properly restrict access to log files, allowing remote attackers without authentication or user interaction to view potentially sensitive data stored in these logs. This vulnerability carries a moderate CVSS score of 5.3 with confirmed public information disclosure impact.

Technical ContextAI

The vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), where the Content Writer plugin for WordPress creates or maintains log files that are accessible to unauthenticated users via direct web requests. WordPress plugins typically store log files in predictable directories (such as /wp-content/plugins/content-writer/logs/ or similar), and improper file permissions or lack of access controls allow these files to be retrieved by any remote attacker. The plugin likely logs debugging information, database queries, configuration details, or user data without implementing adequate authentication checks or HTTP access restrictions (e.g., .htaccess rules, HTTP header controls, or backend authentication gates) to protect these logs from public enumeration and download.

Affected ProductsAI

The Content Writer WordPress plugin is affected in all versions up to and including 3.6.8. The plugin is hosted at https://wordpress.org/plugins/content-writer/ and is distributed through the official WordPress plugin repository. The vulnerability impacts any WordPress installation with this plugin active on versions 3.6.8 or earlier.

RemediationAI

WordPress site administrators should immediately update the Content Writer plugin to a version newer than 3.6.8, which should implement proper access controls to restrict log file visibility. Additionally, administrators should manually restrict access to log files by implementing HTTP authentication, denying direct web access via .htaccess rules (e.g., placing a deny-all directive in the plugin's log directory), or reviewing and deleting existing exposed log files that may contain sensitive information. For detailed patch availability and upgrade instructions, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bb20452b-7049-4567-8288-6d24350e2143?source=cve and the WordPress plugin update interface.