CVE-2026-9016
CVE-2026-9016 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-117.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- EPSS exploit prediction: 0% (17th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-34960
- Weakness: CWE-117
- Published:
- Last modified:
Description
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.
Frequently asked questions
- What is CVE-2026-9016?
- The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.
- How severe is CVE-2026-9016?
- CVE-2026-9016 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2026-9016 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-9016?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-9016 have an EU (EUVD) identifier?
- Yes. CVE-2026-9016 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34960.
- When was CVE-2026-9016 published?
- CVE-2026-9016 was published on 2026-06-06 and last updated on 2026-06-17.
References
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.4.3/bootstrap.php#L123
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.4.3/bootstrap.php#L556
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.4.3/classes/class-debug-log.php#L1947
- https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.4.3/classes/class-debug-log.php#L1961
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3543321%40debug-log-manager&new=3543321%40debug-log-manager&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/25abca87-1be2-427e-ab01-377d52917052?source=cve
Other CWE-117 (Improper Output Neutralization for Logs) vulnerabilities
- CVE-2023-46322 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial…
- CVE-2023-46321 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell…
- CVE-2024-0095 — Critical (CVSS 9.0): NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and…
- CVE-2024-25047 — High (CVSS 8.6): IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application…
- CVE-2025-57564 — High (CVSS 8.2): CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems…
- CVE-2026-10745 — High (CVSS 7.9): Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on…
Browse all CWE-117 (Improper Output Neutralization for Logs) vulnerabilities →