Home

Description

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.

PUBLISHED Reserved 2025-10-11 | Published 2025-10-30 | Updated 2025-10-30 | Assigner Wordfence




MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Problem types

CWE-117 Improper Output Neutralization for Logs

Product status

Default status
unaffected

* (semver)
affected

Timeline

2025-10-11:Vendor Notified
2025-10-29:Disclosed

Credits

Jonas Benjamin Friedli finder

References

www.wordfence.com/...-58d7-4870-b825-a194312fb3e7?source=cve

plugins.trac.wordpress.org/...rs/class_bill_catch_errors.php

plugins.trac.wordpress.org/changeset/3380169/

cve.org (CVE-2025-11627)

nvd.nist.gov (CVE-2025-11627)

Download JSON