What is the CVSS score of CVE-2026-9016?

CVE-2026-9016 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Debug Log Manager CVE-2026-9016

EUVD-2026-34960 MEDIUM

Improper Output Neutralization for Logs (CWE-117)

2026-06-06 Wordfence

GHSA-mqgx-5f5c-w96h

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:21 vuln.today

CVE Published

Jun 06, 2026 - 04:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Debug Log Manager - Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the log_js_errors() AJAX handler being registered for unauthenticated users via wp_ajax_nopriv_log_js_errors and gated only by a nonce that is publicly disclosed in every front-end page's HTML through wp_localize_script() whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the message, script, lineNo, columnNo, and pageUrl fields - enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.

AnalysisAI

Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the log_js_errors() AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_log_js_errors, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via wp_localize_script() whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.

Technical ContextAI

CWE-117 (Improper Output Neutralization for Logs) describes a failure to sanitize or control data written into log files, enabling log injection or log forgery. Here the vulnerability exists in the WordPress plugin debug-log-manager by qriouslad (CPE: cpe:2.3:a:qriouslad:debug_log_manager_-_conveniently_monitor_and_inspect_errors:*:*:*:*:*:*:*:*). WordPress distinguishes privileged AJAX hooks (wp_ajax_*) from unauthenticated ones (wp_ajax_nopriv_*); registering log_js_errors on the nopriv hook explicitly opens it to unauthenticated callers. The nonce mechanism (wp_localize_script) is designed for CSRF protection between authenticated sessions, not as an access control barrier-once the nonce value is embedded in public page HTML, any visitor or automated script can harvest and replay it. The handler accepts attacker-controlled strings for message, script, lineNo, columnNo, and pageUrl, none of which are validated or neutralized before being written to the WordPress debug log, as visible in the referenced source at class-debug-log.php#L1947 and #L1961.

RemediationAI

The primary remediation is to update the Debug Log Manager plugin to a version incorporating changeset 3543321 from the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3543321%40debug-log-manager&new=3543321%40debug-log-manager); note that an exact released patched version number is not independently confirmed from available data-verify the current release tag in the WordPress plugin directory before deploying. As an immediate compensating control, disable the JavaScript error logging feature within the plugin's settings, which eliminates the condition under which the vulnerable nonce is published to page HTML and the AJAX endpoint becomes exploitable-this has no functional impact on PHP error log collection. If JS error logging must remain enabled and patching is delayed, consider implementing a Web Application Firewall rule to block unauthenticated POST requests to wp-admin/admin-ajax.php with action=log_js_errors from sources other than known legitimate front-end clients, though this may interfere with legitimate JS error capture.