Junglewise Threat Intelligence

CVE-2026-9016: WordPress Debug Log Manager log injection in log_js_errors

CVE-2026-9016 · Severity: medium · CVSS 5.3 · Published 2026-06-06

Executive brief

The Debug Log Manager plugin for WordPress, which helps administrators monitor site errors, contains a security flaw that allows unauthorized individuals to write fake entries into the website's system logs. By exploiting this, an attacker can flood the logs with false information to hide malicious activity or trick administrators into believing the site is experiencing technical issues. This could lead to delayed incident response and a loss of trust in the site's diagnostic data.

Technical details

The Debug Log Manager plugin for WordPress is vulnerable to Improper Output Neutralization for Logs (CWE-117) in versions up to and including 2.5.0. The vulnerability exists because the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and is protected only by a security nonce that is publicly exposed in the page HTML when JavaScript error logging is enabled. An unauthenticated attacker can use this nonce to send crafted AJAX requests with arbitrary values for fields such as `message`, `script`, and `pageUrl`. This enables the injection of forged log entries, which can be used to spoof incident records or create 'log noise' to hide actual attacks. A patch is available in versions following 2.5.0.

Affected products

  • WP-Staging Debug Log Manager – Conveniently Monitor and Inspect Errors up to, and including, 2.5.0

Timeline

  • 2026-06-06: advisory: NVD publication date

References