CVE-2025-14280: 
WordPress vulnerability analysis and mitigation

CVE-2025-14280 is a sensitive information exposure vulnerability in the PixelYourSite plugin for WordPress, classified under CWE-200. It affects all versions up to and including 11.1.5, allowing unauthenticated attackers to access sensitive data via publicly exposed log files when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully remediated in version 11.1.5.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat).

The root cause is improper access control over log files generated by the plugin's Meta API logging feature (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When the "Meta API logs" setting is enabled, the plugin writes log data to files that are publicly accessible without authentication via direct HTTP requests. The vulnerability exists in the logger class (class-pys-logger.php) and requires no privileges or user interaction to exploit — an attacker simply needs to know or guess the log file path (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to read potentially sensitive information stored in the plugin's log files, which may include Meta API tokens, event data, or other configuration details depending on what the site transmits to Meta's API. The confidentiality impact is limited in scope (no integrity or availability impact), but exposed API credentials or user data could facilitate further attacks such as unauthorized access to linked Meta advertising accounts or user privacy violations (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14280. The EPSS score is approximately 0.038%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is trivially simple for any attacker who can identify a WordPress site running the affected plugin with Meta API logging enabled, as it requires only a direct HTTP GET request to the exposed log file path (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PixelYourSite plugin (versions ≤ 11.1.5) using tools like WPScan, Shodan, or by inspecting page source for plugin-specific assets.
2. Check for logging enabled: Determine if the "Meta API logs" feature is active — this is disabled by default, so mass scanning for exposed log files is the most practical approach.
3. Locate the log file: Construct a direct HTTP GET request to the publicly accessible log file path within the plugin's directory (e.g., https://target.com/wp-content/plugins/pixelyoursite/<log-file-path>) based on the path structure observed in the plugin's logger class.
4. Retrieve sensitive data: If the log file is accessible, read its contents to extract any sensitive information such as Meta API tokens, event payloads, or user data captured during API interactions (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated HTTP GET requests to paths under /wp-content/plugins/pixelyoursite/ targeting log files (e.g., files with .log extensions); repeated access from a single IP to plugin log file paths.
• Logs: Web server access logs showing 200 OK responses to direct requests for log files within the PixelYourSite plugin directory from unknown or external IP addresses.
• File System: Presence of log files in the PixelYourSite plugin directory containing Meta API data when the logging feature is or was enabled.

Site administrators should update the PixelYourSite plugin to version 11.1.5.1 or later, which fully patches the vulnerability. As an interim workaround, disabling the "Meta API logs" setting in the plugin configuration prevents log files from being generated, eliminating the exposure risk. Additionally, server-level access controls (e.g., .htaccess rules blocking direct access to plugin log files) can provide defense-in-depth (Wordfence, WordPress Trac).

The vulnerability was reported by Wordfence and covered in Sucuri's December 2025 vulnerability patch roundup, indicating routine industry tracking of the issue. No significant public controversy or notable researcher commentary beyond standard disclosure has been observed (Sucuri Blog).