# Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File

- **ID:** WPSEC-2026-1365
- **Plugin:** Dynamic Team Manager – Team Member Showcase with grid, slider, table  Elementor widget & shortcode (`wp-team-manager`), https://wordpress.org/plugins/wp-team-manager/
- **Affected versions:** from 2.3.10 before 2.6.9
- **Fixed in:** 2.6.9 (Update to 2.6.9 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-532
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-team-manager
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1365/

## Description

The Dynamic Team Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log file in all versions up to, and including, 2.6.8. When debug logging is enabled, the plugin writes the log to a fixed, predictable, web-accessible path (wp-content/uploads/wp-team-manager/logs/wtm.log) and does nothing to block direct access. The log records Profile Sync webhook URLs, request signature headers and team member field values. This makes it possible for unauthenticated attackers to download the log and read this data.

## References

- https://wpsec.com/vuln/WPSEC-2026-1365/
- https://plugins.svn.wordpress.org/wp-team-manager/tags/2.6.9/
- https://wordpress.org/plugins/wp-team-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1365/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.