The CE21 Suite plugin for WordPress has a flaw that allows anyone without authentication to read the plugin’s log file, which can contain authentication credentials. Because the plugin’s custom authentication feature records these credentials, an attacker can obtain login details for any user who has previously used the feature, including administrators. This vulnerability is identified as CWE‑532 and effectively provides the attacker with the ability to log in as privileged users and potentially take full control of the site.

WordPress sites running the CE21 Suite plugin version 2.3.1 or earlier are affected. The vulnerability was documented for all releases up to and including 2.3.1; newer releases are expected to have the issue fixed.

With a CVSS score of 9.8, this issue is classified as critical. The EPSS score is less than 1%, indicating that the probability of exploitation in the wild is low at present, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the impact is severe: an unauthenticated attacker who can access the log file can immediately obtain valid credentials, elevate privileges, and potentially take over the entire WordPress installation. The attack vector is straightforward—an attacker simply retrieves the log file publicly accessible through the plugin’s interface or a predictable URL. Because no prior authentication is required, the risk is high for any site still running a vulnerable version.