CVE-2025-5760: 
WordPress vulnerability analysis and mitigation

The Simple History plugin for WordPress (versions prior to 5.8.1) contains a sensitive data exposure vulnerability (CVE-2025-5760) discovered on June 6, 2025. When Detective Mode is enabled, the plugin's logger improperly captures and stores complete $_POST and $_GET data, including password fields from login forms, without proper sanitization in the append_debug_info_to_context() function (NVD, Wiz).

The vulnerability stems from insufficient sanitization in the append_debug_info_to_context() function when Detective Mode is enabled. The plugin logs all POST and GET data, including sensitive password fields from both native WordPress login (wp_login) and third-party login widgets. While some fields properly mask passwords with asterisks, the detective_mode_post_raw field stores them in plain text (GitHub Issue, WordPress Forum). The vulnerability has been assigned a CVSS v3.1 score of 4.9 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

When exploited, this vulnerability allows any authenticated attacker or user whose actions generate a login event to have their password recorded in clear text. Additionally, administrators or users with database read access can retrieve all captured passwords from the logs. This violates security standards like NIST SP 800-63, ISO 27001, and GDPR (WordPress Forum).

The vulnerability has been patched in version 5.8.1 of the Simple History plugin. The fix includes improved password field masking and removal of raw post data from Detective Mode data. Users are advised to update to the latest version immediately. For those unable to update, it is recommended to disable Detective Mode until the update can be applied (GitHub Commit).

The vulnerability was initially reported through the WordPress support forums, where users expressed concerns about compliance with security standards. The plugin's author, Pär Thernström, responded promptly to the report and released a fix after confirming the issue with third-party login systems (WordPress Forum).