The SSP Debug plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 1.0.0. The flaw occurs because the plugin writes PHP error logs to a predictable, web‑accessible directory (wp-content/uploads/ssp-debug/) without any access controls. The log file may contain full URLs, client IP addresses, User‑Agent strings, WordPress user IDs, and internal filesystem paths, which constitutes a CWE‑200 vulnerability.

WordPress sites that have installed the SSP Debug plugin by jimmyredline80, versions up to 1.0.0. The vulnerability is present in every release up to and including the 1.0.0 tag and is not limited to any particular WordPress core version or configuration.

Based on the description, it is inferred that the primary attack vector is a simple unauthenticated HTTP GET request to the predictable log file location (wp-content/uploads/ssp-debug/ssp-debug.log). The CVSS score of 5.3 indicates a moderate severity for information disclosure, and the EPSS score of less than 1% suggests that exploitation is considered rare at the moment. The vulnerability is not listed in the CISA KEV catalog. The risk is principally the exposure of debugging data that could provide an adversary with insights into site structure, user identities, and potentially aid in planning further attacks.