{
 "id": "WPSEC-2026-1365",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1365/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1365/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1365/index.md",
 "title": "Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File",
 "description": "The Dynamic Team Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log file in all versions up to, and including, 2.6.8. When debug logging is enabled, the plugin writes the log to a fixed, predictable, web-accessible path (wp-content/uploads/wp-team-manager/logs/wtm.log) and does nothing to block direct access. The log records Profile Sync webhook URLs, request signature headers and team member field values. This makes it possible for unauthenticated attackers to download the log and read this data.",
 "plugin": {
  "slug": "wp-team-manager",
  "name": "Team Manager",
  "full_name": "Dynamic Team Manager – Team Member Showcase with grid, slider, table  Elementor widget & shortcode",
  "wordpress_org": "https://wordpress.org/plugins/wp-team-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-team-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-team-manager"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.10",
    "from_inclusive": true,
    "to": "2.6.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.10 before 2.6.9"
  ]
 },
 "introduced_in": "2.3.10",
 "fixed_in": "2.6.9",
 "remediation": "Update to 2.6.9 or later.",
 "fix_released": "2026-10-20T03:39:26+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:34:00.250787+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1365/",
  "https://plugins.svn.wordpress.org/wp-team-manager/tags/2.6.9/",
  "https://wordpress.org/plugins/wp-team-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-team-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}