Debug Log Manager CVE-2026-9016

Exploitation requires that the plugin's JavaScript error logging feature be explicitly enabled in the Debug Log Manager configuration-this is the sole technical prerequisite, and without it the nonce is never published to page HTML and the AJAX endpoint cannot be reached by an unauthenticated caller. No authentication is required (CVSS PR:N confirmed), no user interaction is needed (UI:N), and attack complexity is low (AC:L), meaning once the feature is enabled any network-accessible attacker can exploit the issue against default plugin configuration. The limiting factor is entirely the non-default JS error logging toggle: sites with this feature disabled are not exposed regardless of plugin version. No special network position, operating system, or WordPress configuration beyond active plugin installation and the enabled JS logging feature is required.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-complexity, unauthenticated network attack with integrity-only impact and no confidentiality or availability consequence. The attack vector is fully network-accessible with no authentication required per the PR:N vector component. Real-world risk is primarily operational and forensic rather than directly destructive: an attacker cannot escalate privileges, extract data, or crash the service through this vulnerability alone. The primary threat is log integrity poisoning-fabricating error records to hide malicious behavior or exhaust administrator attention. This becomes more serious in environments where the debug log is the sole incident response artifact, as poisoned logs can cause defenders to dismiss real alerts or waste triage effort on fabricated events. The non-default condition (JS error logging must be explicitly enabled) meaningfully reduces the exposed population below the total install base. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, placing it in the lower operational priority tier despite the clean CVSS profile.

An unauthenticated attacker loads any public-facing page of the target WordPress site with the Debug Log Manager's JavaScript error logging feature enabled, parses the page HTML to extract the nonce value injected by wp_localize_script, then issues a crafted POST request to wp-admin/admin-ajax.php with action=log_js_errors and attacker-controlled values for message, script, lineNo, columnNo, and pageUrl. The forged entries are written directly into the WordPress debug log, allowing the attacker to plant misleading records-for example, fabricating hundreds of benign-looking JavaScript errors to bury evidence of a concurrent attack or to trigger false administrator responses.