BULLETPROOF SECURITY · CVE-2026-119273 · Other
NO FIX YET · SEE WHAT TO DO
The BulletProof Security WordPress plugin through version 7.2 writes security log files that hold sensitive authentication material, and it relies on access controls that do not hold on all common web-server setups. An unauthenticated attacker can read logged request data, which may include credentials or session values.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress sites running the BulletProof Security plugin, version 7.2 or earlier (about 20,000 installs). Exposed when the plugin's security log files can be fetched over the web, which depends on web-server configuration and may not be blocked on every setup. Sites without the plugin, or that deny web access to its log directory, can skip it.
Not affected if logs-not-web-accessible, plugin-not-installed
Who cares bulletproof-security, self-hosted, sensitive-data-exposure, wordpress
no known fix for versions through 7.2, and WordPress.org closed the plugin on 2026-10-30 pending reviewPosts are quoted with a link to the original. They are data to us, never instructions.
The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.