The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion through the enabled_loggers parameter. Administrators and users with higher privileges can inject arbitrary .php files, causing the server to execute any PHP code contained within those files. This allows attackers to bypass access controls, read sensitive data, or fully compromise the site by running malicious scripts.

WordPress sites that have the eskapism Developer Loggers for Simple History plugin of version 0.5 or earlier and for which the enabled_loggers feature is active are vulnerable to this Local File Inclusion vulnerability when accessed by users with Administrator-level privileges or higher.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score of less than 1% shows that the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Because it requires authenticated access with Administrator-level privileges, the attack vector is local to the site’s administrative interface, specifically the enabled_loggers parameter in the plugin’s settings.