Vulnerabilities / Team Manager / WPSEC-2026-1365
Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File
Low 3.7
CWE-532Fixed in 2.6.9
- ID
- WPSEC-2026-1365
- Plugin
- Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode (wp-team-manager)
- Affected
- from 2.3.10 before 2.6.9
- Remediation
- Update to 2.6.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Team Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Dynamic Team Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log file in all versions up to, and including, 2.6.8. When debug logging is enabled, the plugin writes the log to a fixed, predictable, web-accessible path (wp-content/uploads/wp-team-manager/logs/wtm.log) and does nothing to block direct access. The log records Profile Sync webhook URLs, request signature headers and team member field values. This makes it possible for unauthenticated attackers to download the log and read this data.
References
- https://wpsec.com/vuln/WPSEC-2026-1365/
- https://plugins.svn.wordpress.org/wp-team-manager/tags/2.6.9/
- https://wordpress.org/plugins/wp-team-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS