CVE-2024-7870: PixelYourSite Information Disclosure Flaw

CVE-2024-7870 Overview

CVE-2024-7870 affects the PixelYourSite and PixelYourSite PRO plugins for WordPress. The plugins expose log files in publicly accessible locations without authentication or access controls. Unauthenticated attackers can read sensitive information from these log files and delete them remotely.

The issue impacts PixelYourSite versions up to and including 9.7.1 and PixelYourSite PRO versions up to and including 10.4.2. The vulnerability is categorized under [CWE-287] (Improper Authentication) and stems from the plugin's logger component writing diagnostic data to a predictable, web-accessible path.

Critical Impact

Unauthenticated remote attackers can retrieve and delete log files that may contain pixel tracking data, API interactions, and other sensitive event metadata.

Affected Products

• PixelYourSite – Your smart PIXEL (TAG) & API Manager (WordPress plugin) — versions up to and including 9.7.1
• PixelYourSite PRO (WordPress plugin) — versions up to and including 10.4.2
• WordPress sites running either plugin with default logger configuration

Discovery Timeline

• 2024-09-04 - CVE-2024-7870 published to NVD
• 2024-10-07 - Last updated in NVD database

Technical Details for CVE-2024-7870

Vulnerability Analysis

The PixelYourSite plugins implement a logging subsystem that records pixel events, API calls, and diagnostic data. The logger writes these entries to files inside the plugin's directory under the WordPress wp-content/plugins/ tree. Because WordPress serves the plugin directory via the web server, these log files become directly retrievable over HTTP without authentication.

An attacker who knows or guesses the log file path can issue a GET request to read its contents. The same endpoint accepts requests that trigger log deletion, allowing destruction of forensic evidence. The plugin's logger does not enforce capability checks, nonce validation, or .htaccess deny rules to restrict access.

The exposure is significant because pixel and tag managers process marketing events that may include user identifiers, email addresses, purchase data, and third-party API tokens. See the GitHub Plugin Logger Code and the WordPress Plugin Class Code for the relevant logger implementation.

Root Cause

The root cause is missing authentication and missing access control on the log file endpoint. The plugin places log files in a predictable, web-served directory and does not add directory protection. No capability check gates read or delete operations against the logger.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an unauthenticated HTTP GET request to the plugin's log file path. To delete logs, the attacker invokes the logger's clear action over the same unauthenticated channel. No user interaction is needed. Refer to the Wordfence Vulnerability Analysis for additional detail.

Detection Methods for CVE-2024-7870

Indicators of Compromise

• Unauthenticated HTTP GET requests targeting paths under /wp-content/plugins/pixelyoursite/ or /wp-content/plugins/pixelyoursite-pro/ that resolve to .log or .txt files
• Requests referencing the plugin's logger class or log clearing parameters originating from external IP addresses
• Sudden truncation or disappearance of plugin log files without an administrator action

Detection Strategies

• Inspect web server access logs for requests to PixelYourSite plugin paths returning HTTP 200 with non-empty response bodies to anonymous clients
• Alert on log file deletion events under the plugin directory using file integrity monitoring
• Correlate scanner User-Agent strings probing WordPress plugin paths against requests for known PixelYourSite logger filenames

Monitoring Recommendations

• Enable file integrity monitoring on the wp-content/plugins/pixelyoursite* directories
• Forward WordPress and web server access logs to a centralized analytics platform and search for the plugin's log endpoint pattern
• Track outbound exposure by running periodic external scans against the plugin paths to verify they return HTTP 403 or 404

How to Mitigate CVE-2024-7870

Immediate Actions Required

• Update PixelYourSite to a version above 9.7.1 and PixelYourSite PRO to a version above 10.4.2
• Delete any existing log files in the plugin directory after confirming they are not needed for troubleshooting
• Review the contents of accessible log files to determine whether sensitive data was exposed and trigger downstream incident response if so

Patch Information

The vendor addressed the issue in changeset 3143047. See the WordPress Plugin Changeset Update for the upstream fix. Administrators should apply the latest plugin release from the WordPress plugin repository.

Workarounds

• Add a deny rule for .log files under the plugin directory in the web server configuration until patching is complete
• Temporarily disable the PixelYourSite logging feature in the plugin settings to stop writing new log data
• Restrict access to /wp-content/plugins/pixelyoursite*/ via WAF rules that block anonymous requests to log file extensions

# Apache .htaccess example to block direct access to plugin log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>