CVE-2025-11891: Shelf Planner Information Disclosure Flaw

CVE-2025-11891 Overview

The Shelf Planner plugin for WordPress contains a sensitive information exposure vulnerability in all versions up to and including 2.8.1. The plugin writes log files to a publicly accessible location on the web server. Unauthenticated attackers can request these log files directly over HTTP and read their contents. The exposed data may include operational details, user actions, or internal application state that assists further attacks. This weakness is tracked under CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory.

Critical Impact
Unauthenticated remote attackers can retrieve log files from vulnerable WordPress sites and harvest sensitive information without authentication or user interaction.

Affected Products

Shelf Planner plugin for WordPress, all versions through 2.8.1
WordPress sites with the plugin installed and active
Web servers serving the plugin directory over HTTP or HTTPS

Discovery Timeline

2025-11-11 - CVE-2025-11891 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11891

Vulnerability Analysis

The Shelf Planner plugin generates log files during normal operation and stores them within its plugin directory under the WordPress wp-content/plugins/ path. The plugin does not restrict web access to these files through .htaccess rules, directory indexing controls, or randomized filenames. Any client that can reach the WordPress site can request the log files directly using their predictable URL paths.

The exposed logs may contain operational data written by the plugin during runtime. Depending on log verbosity, attackers can reconstruct application behavior, identify installed versions, and locate additional attack surface. The vulnerability requires no privileges and no user interaction, only network access to the target site.

Root Cause

The root cause is improper storage of application logs inside a web-accessible directory without access controls. The plugin authors did not place logs outside the document root, add web server denial rules, or use non-guessable filenames. This maps directly to [CWE-538].

Attack Vector

An attacker enumerates the plugin log path using knowledge of the plugin's directory structure. The attacker issues an HTTP GET request to the log file URL and receives the contents in the response body. Automated scanners can perform this enumeration at scale across many WordPress sites. No authentication, session, or interaction with a logged-in user is required.

The vulnerability itself does not permit code execution or data modification, but disclosed information can enable follow-on attacks against the site or its users.

Detection Methods for CVE-2025-11891

Indicators of Compromise

HTTP GET requests to files under /wp-content/plugins/shelf-planner/ targeting .log, .txt, or debug filenames
Repeated 200 OK responses to unauthenticated requests for plugin log paths in web server access logs
Directory enumeration activity followed by targeted requests to log file URLs
User agents associated with vulnerability scanners requesting plugin subdirectories

Detection Strategies

Review web server access logs for unauthenticated requests to wp-content/plugins/shelf-planner/ returning non-empty responses
Deploy web application firewall rules that flag or block direct requests to log files served from plugin directories
Run authenticated site scans that identify publicly readable files inside plugin folders
Monitor for anomalous outbound data volumes from the WordPress host tied to plugin log paths

Monitoring Recommendations

Alert on HTTP 200 responses to .log file requests within any wp-content/plugins/ subdirectory
Track request patterns from single source IPs enumerating multiple plugin directories in short intervals
Correlate log file access events with subsequent login attempts or administrative activity on the same site

How to Mitigate CVE-2025-11891

Immediate Actions Required

Update the Shelf Planner plugin to a version later than 2.8.1 once the vendor publishes a fix
Deactivate the Shelf Planner plugin on affected WordPress sites until a patched release is available
Delete existing log files from the plugin directory and rotate any credentials or tokens that may have appeared in logs
Review the Wordfence Vulnerability Report for vendor updates

Patch Information

At the time of publication, no fixed version is listed in the enriched CVE data. Check the WordPress Plugin Developer Info page for the latest release and changelog entries addressing this issue.

Workarounds

Add web server rules that deny HTTP access to .log files inside the plugin directory
Move log storage outside the WordPress document root by adjusting plugin or PHP configuration where feasible
Restrict access to wp-content/plugins/shelf-planner/ at the reverse proxy or WAF layer to trusted IPs only
Reduce log verbosity so exposed files do not contain sensitive operational data

bash

# Apache .htaccess rule to block log file access in the plugin directory
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>