CVE-2025-13494: SSP Debug WordPress Information Disclosure

CVE-2025-13494 Overview

CVE-2025-13494 is a sensitive information exposure vulnerability affecting the SSP Debug plugin for WordPress in all versions up to and including 1.0.0. The plugin writes PHP error logs to a predictable, web-accessible location at wp-content/uploads/ssp-debug/ssp-debug.log without applying any access controls. Unauthenticated attackers can retrieve the log file directly over HTTP and read debugging data. Exposed content includes full request URLs, client IP addresses, User-Agent strings, WordPress user IDs, and internal filesystem paths. The weakness is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can retrieve WordPress debug logs containing user IDs, IP addresses, and server filesystem paths, aiding reconnaissance for follow-on attacks.

Affected Products

SSP Debug plugin for WordPress, all versions through 1.0.0
WordPress sites that have installed and activated the SSP Debug plugin
Any environment where the plugin's uploads directory is web-accessible

Discovery Timeline

2025-12-05 - CVE-2025-13494 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13494

Vulnerability Analysis

The SSP Debug plugin captures PHP error and debug output and writes it into a log file located at wp-content/uploads/ssp-debug/ssp-debug.log. WordPress serves the uploads directory over HTTP by default, so any file placed inside it is retrievable by direct URL request. The plugin does not add an .htaccess deny rule, a web.config block, or an index.php guard, and it does not randomize the log file name. Anyone who knows the fixed path can request the file and read every line the plugin has recorded.

The log contents include request URLs, client IP addresses, User-Agent headers, WordPress user IDs, and internal filesystem paths. Attackers use this data to enumerate valid user accounts, identify administrative endpoints, and map the server directory layout. Filesystem paths in error traces frequently reveal the operating system, PHP installation location, and third-party plugin directories. The vulnerability itself does not permit code execution or data modification, but it provides reconnaissance value that accelerates targeted follow-on attacks.

Root Cause

The root cause is insecure storage of debug output in a predictable, publicly served directory without access controls. The plugin author placed log output under wp-content/uploads/ for write-permission convenience but did not restrict read access at the web server layer. See the plugin source at WordPress Plugin Trac (ssp-debug.php line 221).

Attack Vector

An unauthenticated remote attacker issues an HTTP GET request to https://target.example/wp-content/uploads/ssp-debug/ssp-debug.log. The web server returns the log file directly. No authentication, session, or user interaction is required. Attackers can automate discovery by requesting this fixed path across large lists of WordPress sites.

Detection Methods for CVE-2025-13494

Indicators of Compromise

HTTP GET requests to /wp-content/uploads/ssp-debug/ssp-debug.log in web server access logs
Successful 200 responses to the log path from IP addresses outside the administrative network
Presence of the file wp-content/uploads/ssp-debug/ssp-debug.log on the WordPress host
Requests to the log path with automated scanner User-Agent strings such as curl, python-requests, or Nuclei

Detection Strategies

Search web server access logs for any request path containing ssp-debug.log and treat successful responses as exposure events.
Inventory installed WordPress plugins across managed hosts and flag any version of ssp-debugging up to 1.0.0.
Run authenticated external scans against WordPress properties to confirm whether the log file is reachable over HTTP.

Monitoring Recommendations

Alert on repeated 4xx and 2xx responses for URIs matching known WordPress debug log patterns under /wp-content/uploads/.
Forward WordPress access logs to a central log store and build a rule for the ssp-debug.log path with source IP context.
Track new file creation under wp-content/uploads/ssp-debug/ on production hosts as a file-integrity signal.

How to Mitigate CVE-2025-13494

Immediate Actions Required

Deactivate and remove the SSP Debug plugin from all WordPress installations until a patched release is available.
Delete the file wp-content/uploads/ssp-debug/ssp-debug.log and the containing directory after preserving a copy for forensic review.
Block external requests to /wp-content/uploads/ssp-debug/ at the web application firewall or reverse proxy.
Rotate any credentials or tokens that may have appeared in exposed debug output.

Patch Information

No fixed version is listed at the time of publication. The vulnerability affects all versions through 1.0.0. Consult the Wordfence Vulnerability Report for updates on a patched release.

Workarounds

Add a deny rule at the web server layer that blocks direct access to .log files under wp-content/uploads/.
Place an .htaccess file in wp-content/uploads/ssp-debug/ with Require all denied on Apache, or an equivalent location block on nginx.
Move the WordPress uploads directory behind authentication if debug logging must remain enabled during troubleshooting.

bash

# nginx configuration example: block direct access to the exposed log path
location ~* /wp-content/uploads/ssp-debug/ {
    deny all;
    return 403;
}