The CloneSite plugin’s client.log.php endpoint fails to enforce authentication, allowing anyone to download the clone operation log. The log contains sensitive internal filesystem paths, URLs of remote servers, and SSH connection details, providing an attacker with configuration and exposure information that could aid further compromise. Because the data is available to unauthenticated users, this represents a clear information disclosure flaw.

Vulnerable installations run WWBN AVideo version 26.0 or earlier and employ the CloneSite plugin without an update that secures client.log.php. All such instances that have not migrated to a newer release that requires administrative authentication are at risk, regardless of other security controls within the plugin.

The flaw carries a CVSS score of 5.3, indicating moderate severity. The probability of exploitation is low, with an EPSS percentile below 1%. The path to disclosure is straightforward: a simple HTTP GET request to /plugin/CloneSite/client.log.php. In environments where attackers could later use the gathered configuration, the impact could extend to component exploitation or privilege escalation.