The Code Quality Control Tool plugin for WordPress has a flaw that lets attackers read log files placed in publicly accessible locations. These log files can contain sensitive data such as configuration details, error messages, or potentially user credentials. The vulnerability is classified as CWE-200 Sensitive Data Exposure and allows an unauthenticated attacker to compromise the confidentiality of the site’s information.

WordPress sites running the Code Quality Control Tool plugin version 2.1 or earlier are affected. The plugin, developed by nickclarkweb, exposes its error logs through the web root, making them available to anyone who can access the site.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1 percent shows that the likelihood of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Exposing log files via a public URL means that an unauthenticated attacker can simply request the log file path and retrieve its contents. Because the logs are served through the normal HTTP interface, no special privileges or additional configuration are needed to exploit this issue.