CVE-2025-11627: WordPress Site Checkup Plugin DoS Flaw

CVE-2025-11627 Overview

CVE-2025-11627 affects the Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress. All versions up to and including 1.47 contain a log file poisoning flaw [CWE-117]. Unauthenticated attackers can inject arbitrary content into plugin log files over the network. Sustained abuse can exhaust disk space and cause denial of service on the affected WordPress host. The issue resides in the plugin's error-handling class located at includes/catch-errors/class_bill_catch_errors.php.

Critical Impact
Unauthenticated remote attackers can write attacker-controlled content into log files, degrade integrity of log data, and trigger denial of service by filling available disk space.

Affected Products

Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress — versions up to and including 1.47
WordPress sites with the plugin installed and active
Hosting environments sharing storage across sites where log volume can impact availability

Discovery Timeline

2025-10-30 - CVE-2025-11627 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11627

Vulnerability Analysis

The vulnerability is a log file poisoning issue classified under [CWE-117] Improper Output Neutralization for Logs. The plugin writes error and diagnostic data to log files without adequately sanitizing or authenticating the inputs that reach the logging routine. Because the entry point is reachable without authentication and requires no user interaction, an attacker can repeatedly submit crafted requests that cause arbitrary strings to be appended to log files.

Two primary consequences follow. First, attackers can forge or corrupt log entries, which undermines the reliability of any investigation that depends on those logs. Second, unbounded writes allow attackers to inflate log files until the storage volume is exhausted, producing a denial of service that can crash the site, block database writes, or take down neighboring services on the same host.

The EPSS probability is 0.315% at the 23.3 percentile, and no public exploit is currently listed.

Root Cause

The root cause is missing neutralization of untrusted input before it is written to log files by the plugin's error catch routine. The affected code path can be reviewed in the plugin source at class_bill_catch_errors.php (line 80). The upstream fix was delivered in WordPress plugin changeset 3380169.

Attack Vector

Exploitation is performed over the network by sending HTTP requests to endpoints handled by the vulnerable plugin. No credentials and no user interaction are required. An attacker automates repeated requests carrying crafted payloads that the plugin appends to disk. See the Wordfence Vulnerability Report and the WordPress Plugin Error Handling source for the vulnerable code path.

No verified proof-of-concept code is available. The vulnerability mechanism is described in prose above.

Detection Methods for CVE-2025-11627

Indicators of Compromise

Rapid, unexplained growth of plugin log files under the site-checkup plugin directory
Repeated unauthenticated requests to plugin endpoints from a small set of source IPs
Log entries containing non-standard characters, control sequences, or forged timestamps
Filesystem or database write failures caused by exhausted disk space on the WordPress host

Detection Strategies

Monitor size and growth rate of files in the Site Checkup plugin log directory and alert on abnormal deltas
Inspect web server access logs for high-volume unauthenticated requests to plugin URLs
Validate log integrity by checking for malformed lines or injected newline sequences

Monitoring Recommendations

Configure disk usage alerts on the WordPress web root and log volumes
Forward WordPress and web server logs to a centralized platform for correlation and retention
Track plugin version inventory across WordPress fleets to identify hosts still running 1.47 or earlier

How to Mitigate CVE-2025-11627

Immediate Actions Required

Update the Site Checkup Debug AI Troubleshooting plugin to a version above 1.47 that includes changeset 3380169
If an update is not immediately possible, deactivate and remove the plugin from affected WordPress sites
Rotate and archive existing plugin log files to preserve forensic evidence before remediation
Review disk usage and free space on affected hosts to prevent cascading denial of service

Patch Information

The fix is published in WordPress Changeset #3380169. Site owners should upgrade to the patched release available through the WordPress plugin repository. Confirm the installed version reports higher than 1.47 after the update.

Workarounds

Restrict access to plugin endpoints at the web server or web application firewall layer until patching completes
Apply rate limiting to unauthenticated requests targeting the WordPress site
Configure log rotation with strict maximum sizes to limit the impact of unbounded writes
Place plugin log files on a dedicated volume so exhaustion cannot affect core WordPress operation

bash

# Example: enforce log rotation for plugin logs on Linux
sudo tee /etc/logrotate.d/site-checkup > /dev/null <<'EOF'
/var/www/html/wp-content/plugins/site-checkup/logs/*.log {
    hourly
    rotate 6
    maxsize 20M
    missingok
    notifempty
    compress
    copytruncate
}
EOF