CVE-2025-10486: Content Writer Plugin Info Disclosure

CVE-2025-10486 Overview

The Content Writer plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 3.6.8. The flaw stems from publicly accessible log files stored within the plugin directory. Unauthenticated remote attackers can retrieve these log files over HTTP and view potentially sensitive information they contain. The issue is classified under CWE-532: Insertion of Sensitive Information into Log File.

Critical Impact
Unauthenticated attackers can read exposed log files on any WordPress site running Content Writer <=3.6.8, potentially harvesting operational data, request metadata, or plugin state information useful for follow-on attacks.

Affected Products

WordPress Content Writer plugin — all versions through 3.6.8
WordPress sites with the plugin installed and log files placed under a web-accessible path
Multi-site WordPress installations where the plugin is network-activated

Discovery Timeline

2025-10-15 - CVE-2025-10486 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10486

Vulnerability Analysis

The Content Writer plugin writes operational data to log files located inside its plugin directory under the WordPress web root. Because these files reside beneath wp-content/plugins/content-writer/, they are directly reachable through the web server without authentication. No access control checks, .htaccess restrictions, or randomized filenames protect the log contents.

An unauthenticated attacker who identifies a WordPress site running the plugin can request the log files directly by URL. The exposed contents may include plugin runtime data, request parameters, error traces, or other information written by the plugin during normal operation. The vulnerability affects confidentiality only — integrity and availability remain intact.

This class of issue is common in WordPress plugins that log to their own directory rather than to a location outside the web root or protected by web server rules. Reference plugin code is available at the WordPress plugin repository.

Root Cause

The root cause is improper storage of log data. The plugin creates log files in a predictable, web-accessible path without applying any deny-by-default web server configuration. WordPress does not automatically restrict access to files inside plugin directories, so any file placed there is served by the web server unless the plugin adds its own protections.

Attack Vector

Exploitation requires only network access to the target site. An attacker enumerates plugin installations using standard WordPress fingerprinting techniques, then issues a direct HTTP GET request to the known log file path. The server returns the log contents in the response body. No authentication, user interaction, or elevated privileges are required.

No verified public proof-of-concept code has been published. The vulnerability is described in the Wordfence vulnerability report.

Detection Methods for CVE-2025-10486

Indicators of Compromise

Unauthenticated HTTP GET requests to files under /wp-content/plugins/content-writer/ with .log, .txt, or similar extensions
Repeated access patterns from a single source IP scanning plugin directories for readable files
Web server access logs showing HTTP 200 responses for requests to plugin log file paths

Detection Strategies

Audit the wp-content/plugins/content-writer/ directory for any files with log-style extensions and confirm whether they are reachable via HTTP
Correlate web server logs with plugin inventory data to flag unauthenticated requests targeting known plugin log paths
Use WordPress security scanners such as Wordfence or WPScan to identify vulnerable plugin versions across the estate

Monitoring Recommendations

Alert on HTTP 200 responses to requests targeting */wp-content/plugins/*/*.log paths
Monitor for user agents and IPs performing sequential directory enumeration against plugin folders
Track plugin version inventory and flag any host running Content Writer <=3.6.8

How to Mitigate CVE-2025-10486

Immediate Actions Required

Update the Content Writer plugin to a version newer than 3.6.8 once a fixed release is available from the vendor
Deactivate and remove the plugin if a patched version is not yet published and the functionality is not business-critical
Delete or move existing log files out of the web-accessible plugin directory and review their contents for previously leaked data

Patch Information

Refer to the Content Writer plugin change log and the WordPress plugin page for the latest release notes and available updates. Verify the installed version through the WordPress admin plugins screen after applying updates.

Workarounds

Add a web server rule denying HTTP access to log files inside the plugin directory, for example an Apache .htaccessFiles directive or an Nginx location block matching \.log$
Restrict access to the entire wp-content/plugins/content-writer/ path at the web application firewall (WAF) layer until a patched plugin version is deployed
Rotate any credentials, API keys, or tokens that may have been written to the exposed log files

bash

# Nginx configuration example to block log file access under the plugin directory
location ~* /wp-content/plugins/content-writer/.*\.(log|txt)$ {
    deny all;
    return 403;
}

# Apache .htaccess equivalent placed in the plugin directory
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>