CVE-2025-11627

MEDIUM

Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each...

Title source: llm

Description

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.

Exploits (1)

nomisec WORKING POC

by jFriedli · poc

https://github.com/jFriedli/CVE-2025-11627

View Code ZIP pw:eip

References (3)

[Product] https://plugins.trac.wordpress.org/browser/site-checkup/tags/1.47/includes/catch-errors/class_bill_catch_errors.php#L80

[Product] https://plugins.trac.wordpress.org/changeset/3380169/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=cve

Scores

CVSS v3 6.5

EPSS 0.0018

EPSS Percentile 39.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-117

Status published

Products (1)

sminozzi/Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue < 1.47

Published Oct 30, 2025

Tracked Since Feb 18, 2026