{"id":"CVE-2026-119273","kind":"vulnerability","aliases":["CVE-2026-119273"],"related":[],"title":"BulletProof Security WordPress plugin: unauthenticated users can read security logs","description":"The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.","summary":"The BulletProof Security WordPress plugin through version 7.2 writes security log files that hold sensitive authentication material, and it relies on access controls that do not hold on all common web-server setups. An unauthenticated attacker can read logged request data, which may include credentials or session values.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BulletProof Security","fixed":[],"affected":"<= 7.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bulletproof-security","other","self-hosted","sensitive-data-exposure","wordpress"],"not_affected_if":["logs-not-web-accessible","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check the BulletProof Security version; 7.2 and earlier are affected (7.2 is the latest release).\n- No source names the log file path: the WPScan entry omits it and its PoC is withheld until 2026-11-21. Unknown until then. Meanwhile, look in the plugin's own folders under wp-content for log files and test whether any load in a browser without logging in.\n- If logs were reachable, rotate any credentials or session values they may hold.","fix":"No fixed version known. WPScan lists 'no known fix' for versions through 7.2, and WordPress.org closed the plugin on 2026-10-30 pending review. Until a patched release exists, deactivate or replace the plugin, or block web access to its log files at the web server.","status":"open","published_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","triaged_at":"2026-11-10T06:22:23+00:00","updated_at":"2026-11-10T06:24:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T06:22:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BulletProof Security WordPress plugin: unauthenticated users can read security logs","impact":"medium","summary":"The BulletProof Security WordPress plugin through version 7.2 writes security log files that hold sensitive authentication material, and it relies on access controls that do not hold on all common web-server setups. An unauthenticated attacker can read logged request data, which may include credentials or session values.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","bulletproof-security","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers read logged authentication material and request data","analyst_note":"Confirm the fixed version and log-file path from the NVD entry and the plugin's changelog; the sources give no fix.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list; the sources say versions through 7.2 are affected\n- Look for the plugin's security log files under the web root and test whether they are reachable by requesting them in a browser\n- unknown for other checks, as the sources do not say","plain_action":"","product_name":"BulletProof Security","needs_analyst":true,"not_affected_if":["plugin-not-installed","logs-not-web-accessible"],"who_is_affected":"Sites running the BulletProof Security WordPress plugin through 7.2 where the security log files are web-accessible. The sources say the access controls fail under some common web-server configurations, so a site can be exposed even with default settings. Sites that do not run the plugin, or that block direct access to its log directory at the web server, are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4543,"output_tokens":620,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and log-file path from the NVD entry and the plugin's changelog; the sources give no fix.","search":"'-119273':13A,16A '-2026':12A,15A '7.2':38B,86C 'access':52B,107C 'affect':129C 'allow':120C 'attack':67B,122C 'authent':46B,98C 'bulletproof':1A,17A,20B,32B,81C 'bulletproof-secur':19B 'common':60B,115C 'configur':119C 'control':53B,108C 'credenti':76B 'cve':11A,14A 'data':28B,72B,127C 'deploy':130C 'enforc':112C 'exposur':29B 'file':42B,94C 'hold':44B,57B 'host':25B 'includ':75B 'log':10A,41B,70B,93C,125C 'materi':47B,99C 'may':74B 'plugin':4A,35B,84C 'prevent':96C 'protect':90C 'read':8A,69B,124C 'reli':50B,105C 'request':71B,126C 'secur':2A,9A,21B,33B,40B,82C,92C 'security':18A 'self':24B 'self-host':23B 'sensit':27B,45B,97C 'sensitive-data-exposur':26B 'server':63B,118C 'session':78B 'setup':64B 'suffici':89C 'unauthent':5A,66B,121C 'user':6A 'valu':79B 'version':37B 'web':62B,117C 'web-serv':61B,116C 'wordpress':3A,30B,34B,83C 'write':39B 'written':102C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the BulletProof Security plugin, version 7.2 or earlier (about 20,000 installs). Exposed when the plugin's security log files can be fetched over the web, which depends on web-server configuration and may not be blocked on every setup. Sites without the plugin, or that deny web access to its log directory, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bulletproofsecurity","security"],"ptokens":["bulletproof","security"],"labels":["bulletproofsecurity","high","other","selfhosted","sensitivedataexposure","vendor","wordpress"],"campaign_type":null,"search_a":"'-119273':13A,16A '-2026':12A,15A 'bulletproof':1A,17A 'cve':11A,14A 'log':10A 'plugin':4A 'read':8A 'secur':2A,9A 'security':18A 'unauthent':5A 'user':6A 'wordpress':3A","search_b":"'7.2':38B 'access':52B 'attack':67B 'authent':46B 'bulletproof':20B,32B 'bulletproof-secur':19B 'common':60B 'control':53B 'credenti':76B 'data':28B,72B 'exposur':29B 'file':42B 'hold':44B,57B 'host':25B 'includ':75B 'log':41B,70B 'materi':47B 'may':74B 'plugin':35B 'read':69B 'reli':50B 'request':71B 'secur':21B,33B,40B 'self':24B 'self-host':23B 'sensit':27B,45B 'sensitive-data-exposur':26B 'server':63B 'session':78B 'setup':64B 'unauthent':66B 'valu':79B 'version':37B 'web':62B 'web-serv':61B 'wordpress':30B,34B 'write':39B","search_c":"'7.2':86C 'access':107C 'affect':129C 'allow':120C 'attack':122C 'authent':98C 'bulletproof':81C 'common':115C 'configur':119C 'control':108C 'data':127C 'deploy':130C 'enforc':112C 'file':94C 'log':93C,125C 'materi':99C 'plugin':84C 'prevent':96C 'protect':90C 'read':124C 'reli':105C 'request':126C 'secur':82C,92C 'sensit':97C 'server':118C 'suffici':89C 'unauthent':121C 'web':117C 'web-serv':116C 'wordpress':83C 'written':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T06:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119273","severity":null,"published_at":"2026-11-10T06:17:08+00:00","modified_at":"2026-11-10T06:17:08+00:00","first_seen_at":"2026-11-10T06:20:23+00:00","fetched_at":"2026-11-10T06:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119273:2419","url":"https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/","severity":null,"published_at":"2026-11-10T06:24:45+00:00","modified_at":"2026-11-10T06:24:49+00:00","first_seen_at":"2026-11-10T06:24:45+00:00","fetched_at":"2026-11-10T06:24:49+00:00","note":"Corrected how-to-check: removed file paths I had written without a source.","cites":["https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/","https://wordpress.org/plugins/bulletproof-security/"]}],"documents":[{"id":113497,"url":"https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/","title":"BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security Log (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":113498,"url":"https://wordpress.org/plugins/bulletproof-security/","title":"BulletProof Security - WordPress.org plugin page (closed Oct 30, 2026)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}