Description
The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.
Published: 2025-10-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Log File Poisoning capable of inserting arbitrary data into logs and potentially causing disk exhaustion leading to denial of service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows unauthenticated attackers to inject arbitrary content into the plugin’s log files. The inserted content can corrupt logs or trigger log file exhaustion, resulting in denial of service. The weakness corresponds to CWE‑117, indicating insufficient input validation before writing to a file.

Affected Systems

Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue WordPress plugin, versions 1.47 and older. Sites running any of these versions should verify the installed plugin version and plan an upgrade.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by sending crafted data to the plugin’s logging mechanism, which appends it to a file. This can drain disk space or corrupt logs, disrupting site operations.

Generated by OpenCVE AI on April 22, 2026 at 14:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin to the latest available version
  • Configure the log directory with strict write permissions or relocate logs to a secure, rotatable location
  • Monitor disk usage and enforce quotas on the log directory to prevent disk exhaustion

Generated by OpenCVE AI on April 22, 2026 at 14:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 30 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Oct 2025 05:45:00 +0000

Type Values Removed Values Added
Description The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.
Title Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
Weaknesses CWE-117
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:52:13.544Z

Reserved: 2025-10-11T00:05:00.552Z

Link: CVE-2025-11627

cve-icon Vulnrichment

Updated: 2025-10-30T13:53:04.857Z

cve-icon NVD

Status : Deferred

Published: 2025-10-30T06:15:43.757

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-11627

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T14:15:20Z

Weaknesses