Debug Log Manager Conveniently Monitor And Inspect Errors
Monthly
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Log injection in the Debug Log Manager WordPress plugin (versions up to and including 2.5.0) allows unauthenticated remote attackers to write arbitrary forged entries into the site's debug log. The root cause is a broken authorization design: the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors`, and the only gate-a WordPress nonce-is publicly broadcast in every page's front-end HTML via `wp_localize_script()` whenever JavaScript error logging is enabled, rendering it non-secret and thus non-protective. Exploitation enables log spoofing, masking of real malicious activity behind fabricated noise, and manipulation of administrator triage decisions. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.