CVE-2025-67561: 
WordPress vulnerability analysis and mitigation

CVE-2025-67561 is a Missing Authorization vulnerability in the Debug Log Viewer WordPress plugin developed by Oleksandr Lysyi. It allows attackers to exploit incorrectly configured access control security levels (CWE-862), potentially enabling unauthorized access to debug log data. All versions up to and including 2.0.3 are affected. The vulnerability was published on December 9, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) with an adjacent network attack vector (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify that a requesting user has the appropriate permissions before granting access to sensitive functionality or data. The attack vector is adjacent network (AV:A), requiring no authentication (PR:N) and no user interaction (UI:N), with low attack complexity. This suggests that an attacker on the same network segment can send crafted requests to plugin endpoints that expose debug log content without proper capability checks (Feedly, Patchstack).

Successful exploitation results in low confidentiality impact (exposure of debug log contents, which may include sensitive application data, credentials, or internal paths) and low integrity impact (potential unauthorized modification of plugin-controlled resources), with no availability impact. Debug logs in WordPress environments can contain stack traces, database queries, API keys, and user data, making their unauthorized exposure a meaningful information disclosure risk. The scope is unchanged, limiting blast radius to the affected WordPress installation (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-67561 as of the available data. The EPSS score is very low at 0.028%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Debug Log Viewer plugin (version ≤ 2.0.3) using tools like WPScan or by checking /wp-content/plugins/debug-log-viewer/ for plugin presence from an adjacent network position.
2. Identify unprotected endpoints: Review the plugin's registered REST API routes or admin-ajax actions that handle log viewing/download functionality — these are the endpoints lacking proper capability checks.
3. Send unauthenticated request: Craft an HTTP request (e.g., a GET or POST to the vulnerable endpoint) without authentication headers, exploiting the missing authorization check to access debug log data.
4. Retrieve sensitive data: Parse the returned debug log content for sensitive information such as credentials, internal paths, API keys, or application errors that can be leveraged for further attacks (Feedly).

• Network: Unexpected HTTP requests to WordPress plugin endpoints associated with debug-log-viewer (e.g., paths containing /wp-admin/admin-ajax.php with debug log viewer action parameters, or REST API routes registered by the plugin) originating from adjacent network hosts without valid session cookies.
• Logs: WordPress access logs showing unauthenticated or low-privilege requests successfully returning HTTP 200 responses from debug log viewer endpoints; repeated access to log-related plugin URLs.
• File System: Unexpected access timestamps on debug.log or plugin-managed log files in wp-content/ directories.

Users should update the Debug Log Viewer plugin to a version beyond 2.0.3 as soon as a patched release is available from the plugin author (Oleksandr Lysyi) or the WordPress plugin repository. As an interim workaround, administrators should deactivate and remove the plugin if debug logging is not actively required. Additionally, restricting network access to the WordPress admin interface and implementing a Web Application Firewall (WAF) rule to block unauthenticated requests to plugin-specific endpoints can reduce exposure (Patchstack).