The Debug Log Manager plugin for WordPress allows unauthenticated attackers to craft arbitrary entries in the site's debug log by invoking the log_js_errors AJAX action and submitting malicious values for message, script, lineNo, columnNo, and pageUrl. The attacker can therefore fabricate error records that obscure true incidents and mislead administrators relying on log information for monitoring and triage.

WordPress sites using the Debug Log Manager – Conveniently Monitor and Inspect Errors plugin, any release up to and including 2.5.0. The vulnerability exists only when JavaScript error logging is enabled, which is the default when the feature is activated.

The vulnerability scores a CVSS of 5.3, indicating moderate severity, and has no EPSS score available to indicate exploitation probability. It is not listed in the CISA KEV catalog. Attackers can trigger the flaw from any unauthenticated user when the plugin is enabled, as the AJAX handler is registered for all visitors and the nonce required for the request is rendered publicly on every front‑end page that has error logging active. Consequently, remote access to the site is sufficient to inject fabricated log entries, a risk that can be mitigated by an appropriate update or configuration change.