The PixelYourSite WordPress plugin writes log files that, when the "Meta API logs" option is enabled, are accessible from the web. Unauthenticated attackers can read these files and obtain potentially confidential data. The weakness is a classic information‑exposure flaw identified as CWE‑200.

All versions of PixelYourSite up to and including 11.1.5 are affected. The vulnerability is resolved in 11.1.5.1; upgrading to that version removes the exposed log‑file path and stops the disclosure.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% reflects a very low likelihood of exploitation. Because the log files can be read over HTTP without authentication, the attack vector is unauthenticated network access, but in practice attackers would need to know the URL of the log file or rely on the credentials of a site administrator who has left the setting enabled.