CVE-2024-34559: Ghost CMS Information Disclosure Flaw

CVE-2024-34559 Overview

CVE-2024-34559 is an information disclosure vulnerability in the Ghost Foundation Ghost plugin for WordPress. The flaw involves the insertion of sensitive information into a log file [CWE-532], affecting all versions up to and including 1.4.0. An unauthenticated remote attacker can access exposed log data over the network without user interaction.

The vulnerability impacts confidentiality but does not affect integrity or availability. Successful exploitation can reveal sensitive operational data captured during plugin activity. The issue is tracked under CWE-532 (Insertion of Sensitive Information into Log File).

Critical Impact
Unauthenticated attackers can retrieve sensitive data written to plugin log files, exposing information useful for follow-on attacks against the WordPress site.

Affected Products

Ghost Foundation Ghost plugin for WordPress
Versions from unspecified initial release through 1.4.0
WordPress sites with the Ghost plugin installed and active

Discovery Timeline

2024-05-14 - CVE-2024-34559 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-34559

Vulnerability Analysis

The Ghost plugin writes sensitive information into a log file that is accessible without authentication. CWE-532 covers cases where developers log diagnostic data, request parameters, tokens, or internal state into files that an attacker can later retrieve. Because the log file is reachable over the network, an attacker requires no credentials and no user interaction to extract its contents.

The attack scope is limited to confidentiality. Integrity and availability of the WordPress site remain intact, but disclosed information can be chained with other weaknesses. Common artifacts found in plugin logs include API keys, internal paths, error stack traces, and request payloads.

The EPSS probability of 0.729% places this issue in the 72.96 percentile of exploit likelihood, indicating moderate attacker interest relative to other CVEs. The Patchstack advisory describes the issue as sensitive data exposure via a log file.

Root Cause

The plugin generates log files that contain sensitive runtime data without restricting filesystem permissions or web-accessible paths. WordPress plugins frequently write logs into directories under wp-content/, which are served directly by the web server unless explicitly blocked. When no .htaccess rule, randomized filename, or access control protects the log, the file becomes retrievable by anyone who knows or guesses its URL.

Attack Vector

An attacker issues an HTTP GET request to the predictable log file path exposed by the Ghost plugin. The web server returns the file contents, revealing sensitive entries written by the plugin during normal operation. No authentication, session, or user interaction is required, and the request appears as routine web traffic in standard logs.

For technical specifics, refer to the Patchstack Vulnerability Analysis.

Detection Methods for CVE-2024-34559

Indicators of Compromise

Unexpected HTTP GET requests targeting log files under the Ghost plugin directory in wp-content/plugins/ or related upload paths
Web server access logs showing successful 200 responses for .log, .txt, or similarly named files associated with the plugin
External IP addresses repeatedly probing predictable log filenames on the WordPress host

Detection Strategies

Audit the WordPress installation for files created by the Ghost plugin that contain credentials, tokens, or request data
Correlate web access logs with file inventories to identify whether log files have been retrieved externally
Deploy web application firewall rules to flag requests for log file extensions inside plugin directories

Monitoring Recommendations

Monitor wp-content/ for newly created log files and validate their access permissions
Alert on HTTP responses serving plain-text log content from plugin directories
Track outbound use of any credentials or tokens that may have appeared in plugin logs

How to Mitigate CVE-2024-34559

Immediate Actions Required

Update the Ghost plugin to a version newer than 1.4.0 once the vendor publishes a fix
Remove or relocate existing log files generated by the plugin to a location outside the web root
Rotate any credentials, API keys, or tokens that may have been written to the affected log files

Patch Information

The Patchstack advisory tracks the affected range as versions up through 1.4.0. Administrators should consult the Patchstack Vulnerability Analysis for the latest fixed version and upgrade guidance from Ghost Foundation.

Workarounds

Block direct web access to plugin log files using an .htaccess deny rule or equivalent web server configuration
Disable verbose or debug logging within the Ghost plugin where the option is available
Restrict filesystem permissions on the plugin's log directory to prevent web-tier read access

bash

# Apache .htaccess example to block access to log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>