CVE-2024-35669: Bowo Debug Log Manager Auth Bypass Flaw

CVE-2024-35669 Overview

CVE-2024-35669 is a Missing Authorization vulnerability [CWE-862] in the Bowo Debug Log Manager plugin for WordPress. The flaw affects all versions up to and including 2.3.1. Authenticated attackers with low privileges can access functionality reserved for higher-privileged users. The vulnerability enables broken access control against confidentiality, integrity, and availability of affected WordPress sites.

Critical Impact
An authenticated attacker with low-level privileges can bypass authorization checks and interact with debug log management functions, leading to sensitive log exposure and site tampering.

Affected Products

Bowo Debug Log Manager plugin for WordPress
All versions from n/a through 2.3.1
WordPress sites running the vulnerable plugin

Discovery Timeline

2024-06-09 - CVE-2024-35669 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35669

Vulnerability Analysis

The Debug Log Manager plugin exposes administrative actions without properly verifying the caller's role or capability. The plugin fails to enforce capability checks such as current_user_can() on sensitive endpoints. Any authenticated user, including subscribers, can invoke these endpoints over the network.

Because debug logs frequently contain stack traces, file paths, database queries, and occasionally credentials or tokens, unauthorized access to log management functions leads to information disclosure. Attackers can also manipulate or clear logs to hinder incident response and forensic investigation.

Root Cause

The root cause is missing authorization enforcement [CWE-862] on plugin action handlers. The plugin registers AJAX or admin-post handlers but omits capability verification. Nonce checks alone do not restrict access to privileged users, so any logged-in user with a valid nonce can trigger the action.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session with minimal privileges. The attacker sends crafted HTTP requests to the plugin's action endpoints. No user interaction from an administrator is required. Successful exploitation yields access to debug log contents and log management operations reserved for administrators.

See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-35669

Indicators of Compromise

Unexpected HTTP POST requests to admin-ajax.php referencing Debug Log Manager actions from low-privilege user sessions.
Access to wp-content/debug.log or plugin-managed log files by non-administrator accounts.
Log files unexpectedly cleared, downloaded, or truncated outside of scheduled maintenance.

Detection Strategies

Audit WordPress access logs for requests to Debug Log Manager endpoints originating from subscriber or contributor accounts.
Correlate authenticated session activity with plugin action invocations that require administrative capability.
Monitor filesystem access to the WordPress debug log path for reads or writes by web-application processes tied to non-admin sessions.

Monitoring Recommendations

Enable WordPress activity logging to capture plugin actions per user role.
Alert on privilege-inconsistent AJAX action calls tied to the debug-log-manager slug.
Track version inventory of installed WordPress plugins and flag hosts still running Debug Log Manager 2.3.1 or earlier.

How to Mitigate CVE-2024-35669

Immediate Actions Required

Update Bowo Debug Log Manager to a version later than 2.3.1 once the vendor releases a fixed release.
Restrict user registration and audit existing low-privilege accounts on affected WordPress sites.
Rotate any credentials, API keys, or tokens that may have appeared in exposed debug logs.

Patch Information

At the time of the NVD entry, the advisory identifies affected versions from n/a through 2.3.1. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for a patched release.

Workarounds

Deactivate and remove the Debug Log Manager plugin until a fixed version is installed.
Disable WP_DEBUG_LOG in wp-config.php to prevent sensitive information from being written to disk.
Apply Web Application Firewall rules that block Debug Log Manager AJAX actions from non-administrator sessions.

bash

# Configuration example: disable debug logging in wp-config.php
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );