High-severity findings.

Audited release

1.0.4

Findings

3

Worst severity

high

Content hash

3068ec81b0242550b46fd561… Copy

Findings

• high Unauthenticated debug.log disclosure via ?cbxwpwritelog=1

  information_disclosure

  cbxwpwritelog_log_viewer is hooked to template_redirect and, when WP_DEBUG is true, treats $_REQUEST['cbxwpwritelog']==1 as sufficient authorization. There is no current_user_can, is_user_logged_in, or nonce check. The handler instantiates Php_Error_Log_Viewer\LogHandler with file_path = WP_CONTENT_DIR.'/debug.log', then AjaxHandler::handle_ajax_requests() which, on GET get_log, prints json_encode of the parsed log and dies. Visiting /?cbxwpwritelog=1 without get_log echoes the bundled Vue GUI (templates/log_view.php), which auto-polls ?get_log&cbxwpwritelog=1 every 4s. The admin-bar "View Error Log" node is gated on manage_options, but that function never runs on this path — it only adds a link. WP_DEBUG is the plugin's intended operating mode (README instructs defining it and documents http://your_domain/?cbxwpwritelog=1). Observable: an unauthenticated GET to /?cbxwpwritelog=1&get_log returns the contents of wp-content/debug.log as JSON (paths, stack traces, query/API failures, and mail errors if email logging constants are enabled), bypassing web-server rules that deny the raw debug.log URL.

  cbxwpwritelog.php:145-176

  Recommendation

  Require current_user_can('manage_options') (or a dedicated capability) and a valid nonce before rendering the viewer or serving get_log/filesize/delete_log. Do not treat WP_DEBUG as an access-control check. Keep the viewer in wp-admin rather than a public query var, and deny HTTP access to vendor/php-error-log-viewer/index.php (standalone copy of the same AjaxHandler with no WordPress auth).

• medium Unauthenticated GET truncates wp-content/debug.log

  missing_auth

  The same unauthenticated template_redirect handler calls AjaxHandler::handle_ajax_requests() on every ?cbxwpwritelog=1 request. If $_GET['delete_log'] is set, ajax_delete() invokes LogHandler::delete(), which fopen()s WP_CONTENT_DIR.'/debug.log' in r+ and ftruncate()s it to zero bytes, then echoes 'Emptied file'. There is no capability check and no nonce; the Vue UI triggers it with axios.get('?delete_log&cbxwpwritelog=1'). Because the action is a GET, a cross-site img/prefetch or a logged-in admin visiting an attacker page will empty the log whenever WP_DEBUG is on. Observable: GET /?cbxwpwritelog=1&delete_log returns JSON/text 'Emptied file' and debug.log size becomes 0, destroying forensic evidence. Limited blast (one file, not RCE), so medium rather than high.

  vendor/php-error-log-viewer/src/AjaxHandler.php:20-33,70-75

  Recommendation

  Gate delete_log on manage_options plus check_admin_referer / check_ajax_referer. Use POST (not GET) for a destructive action. Refuse the request for unauthenticated users even when WP_DEBUG is true.

• medium Stored XSS in log viewer via vscode_link_filter and v-html

  xss_stored

  Log lines are htmlspecialchars(..., ENT_QUOTES) then passed to link_vscode_files(), which wraps filesystem-like matches in <a href='$link'> with $link built from the already-encoded match. HTML character references such as ' (from a single quote in the original log line) are decoded by the browser when parsing the href attribute, so a path like /x.php'onclick='alert(1)'/y.php on line 1 becomes <a href='vscode://file//x.php'onclick='alert(1)'/y.php:1'> and breaks out to an onclick handler. templates/log_view.php inserts item.msg with Vue v-html (innerHTML); event handlers in that markup execute. vscode_links defaults to true and the WordPress wrapper does not disable it. Consumer is the public log GUI at /?cbxwpwritelog=1 (and any admin using the toolbar link). Exploitation needs a matching line in debug.log (PHP notices/warnings that interpolate attacker-influenced strings, or write_log() of request data). Not a free-form reflected XSS from this plugin's own query args.

  vendor/php-error-log-viewer/src/LogHandler.php:132-145,174-175

  Recommendation

  Build vscode hrefs with esc_url() / htmlspecialchars on the full attribute value, or skip HTML and let the frontend create links from structured path/line fields. Prefer v-text over v-html. Disable vscode_links unless explicitly enabled in wp-admin. Fixing the missing-auth gate on the viewer also stops unauthenticated users from hitting this sink.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.