The Content Writer plugin for WordPress permits unauthenticated viewing of log files that can contain sensitive data. The weakness originates from publicly exposed log files due to missing access controls, matching CWE‑532. This allows an attacker to retrieve potentially confidential information by accessing the log file URL. Affected systems are installations of the steadycontent Content Writer plugin for WordPress in any version up to and including 3.6.8, regardless of user permissions. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers can reach the exposed log files directly via a web request, so administrators should remedy the issue promptly by updating the plugin, restricting log file access, or removing the logs.

Installations of the steadycontent Content Writer plugin for WordPress, versions 3.6.8 and earlier, deployed on any WordPress site are affected.

The vulnerability carries a medium severity CVSS score of 5.3. The EPSS value of under 1% points to a low probability of exploitation in the near term. The vulnerability is not present in the CISA KEV catalog. Adversaries can exploit it by issuing a simple HTTP request to the publicly accessible log file URL, requiring no authentication or elevated privileges. This straightforward attacker path increases risk for sites with publicly readable logs.