CVE-2025-14280
Sensitive Information Exposure in PixelYourSite WordPress Plugin Logs
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | pixel_yoursite | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The PixelYourSite plugin for WordPress has a vulnerability in versions up to 11.1.5 that allows unauthenticated attackers to access sensitive information through publicly exposed log files if the "Meta API logs" setting is enabled. This setting is disabled by default. The vulnerability was partially fixed in version 11.1.5 and fully fixed in 11.1.5.1.
How can this vulnerability impact me? :
This vulnerability can allow attackers who are not logged in to view sensitive information contained in the exposed log files, potentially leading to information disclosure risks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the PixelYourSite plugin version is up to and including 11.1.5 and if the 'Meta API logs' setting is enabled. Additionally, look for publicly exposed log files related to the plugin on your server. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately disable the 'Meta API logs' setting if it is enabled, as it is disabled by default. Also, update the PixelYourSite plugin to version 11.1.5.1 or later, where the vulnerability is fully patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability exposes potentially sensitive information through publicly accessible log files, which could include Personally Identifiable Information (PII). This exposure risks non-compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive data. The plugin updates (versions 11.1.5 and 11.1.5.1) introduced protections like restricting access to log files, creating protection files, and randomizing log file names to mitigate unauthorized access and reduce the risk of sensitive data exposure, thereby improving compliance posture. [3, 4]