The Seraphinite Accelerator WordPress plugin allows authenticated users with a Subscriber role or higher to invoke a missing capability check on an AJAX action named seraph_accel_api with fn=LogClear, enabling these users to erase the plugin’s debug and operational logs. This activity undermines forensic continuity and auditability but does not provide direct code execution or broader system compromise. The vulnerability is a classic missing authorization flaw, corresponding to CWE‑862.

All installations of Seraphinite Accelerator up through version 2.28.14, deployed on WordPress sites, are affected. The issue resides in the plugin’s core AJAX handling code, specifically the LogClear function exposed via the admin‑ajax.php endpoint.

The overall severity is moderate with a CVSS score of 4.3. The EPSS score is below 1 %, indicating that exploit attempts are currently expected to be very uncommon. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers would need to authenticate to the site with a Subscriber‑level or higher role and issue the specific AJAX request, a condition that is relatively easy to meet on any site that grants such permissions, but the impact is limited to log visibility rather than system control.