CVE-2025-11627CWE-117

CVE-2025-11627

Medium · published October 30, 2025

CVSS v3.1

6.5

EPSS

Percentile

26.8

In the wild

Unconfirmed

What it is

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00345 · 26.8th percentile
Weakness: CWE-117 · Improper Output Neutralization for Logs
Published: 2025-10-30T10:15Z

References (3)

https://plugins.trac.wordpress.org/browser/site-checkup/tags/1.47/includes/catch-errors/class_bill_catch_errors.php#L80 · [email protected]https://plugins.trac.wordpress.org/changeset/3380169/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=cve · [email protected]

EPSS history

Timeline

30 OCT 05:28Z
Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
cvelistv5