---
id: "CVE-2026-119273"
page: "https://infrastack.ai/live/CVE-2026-119273"
kind: "vulnerability"
aliases: ["CVE-2026-119273"]
title: "BulletProof Security WordPress plugin: unauthenticated users can read security logs"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "BulletProof Security", "fixed": [], "affected": "<= 7.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bulletproof-security", "other", "self-hosted", "sensitive-data-exposure", "wordpress"]
not_affected_if: ["logs-not-web-accessible", "plugin-not-installed"]
published_at: "2026-11-10T06:17:08+00:00"
first_seen_at: "2026-11-10T06:20:23+00:00"
updated_at: "2026-11-10T06:24:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119273", "first_seen_at": "2026-11-10T06:20:23+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/", "first_seen_at": "2026-11-10T06:24:45+00:00", "cites": ["https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/", "https://wordpress.org/plugins/bulletproof-security/"]}]
exploit_sources: []
---

# BulletProof Security WordPress plugin: unauthenticated users can read security logs

Link for people: https://infrastack.ai/live/CVE-2026-119273 (this .md is for agents)

The BulletProof Security WordPress plugin through version 7.2 writes security log files that hold sensitive authentication material, and it relies on access controls that do not hold on all common web-server setups. An unauthenticated attacker can read logged request data, which may include credentials or session values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BulletProof Security affected <= 7.2 fixed no fixed version listed

## How to check

- In WordPress admin > Plugins, check the BulletProof Security version; 7.2 and earlier are affected (7.2 is the latest release).
- No source names the log file path: the WPScan entry omits it and its PoC is withheld until 2026-11-21. Unknown until then. Meanwhile, look in the plugin's own folders under wp-content for log files and test whether any load in a browser without logging in.
- If logs were reachable, rotate any credentials or session values they may hold.

## Fix

No fixed version known. WPScan lists 'no known fix' for versions through 7.2, and WordPress.org closed the plugin on 2026-10-30 pending review. Until a patched release exists, deactivate or replace the plugin, or block web access to its log files at the web server.

## Timeline

- 2026-11-10T06:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119273
- 2026-11-10T06:24:45+00:00 analyst https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/ — Corrected how-to-check: removed file paths I had written without a source.

## Documents

- [advisory] BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security Log (WPScan) https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/
- [describes] BulletProof Security - WordPress.org plugin page (closed Oct 30, 2026) https://wordpress.org/plugins/bulletproof-security/

## From the sources

The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_