Vulnerabilities / Titan Anti-spam & Security / WPSEC-2026-1978
Titan Anti-spam & Security <= 7.5.4 - Unauthenticated Sensitive Information Exposure via Debug Log Export
Low 3.7
CWE-552Fixed in 7.5.5
- ID
- WPSEC-2026-1978
- Plugin
- Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter (anti-spam)
- Affected
- from 7.5.0 before 7.5.5
- Remediation
- Update to 7.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Titan Anti-spam & Security on WPSec AttackSurface
- Fix released
- Published
Description
The Titan Anti-spam & Security plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log export feature in all versions up to, and including, 7.5.4. This is due to the export ZIP archive, which contains the plugin's logs and system information, being written to the public uploads directory under a predictable date-based filename (titan_debug_report-YYYY-MM-DD.zip) and never being removed. This makes it possible for unauthenticated attackers to download the archive and read potentially sensitive log and system data after an administrator has exported the logs.
References
- https://wpsec.com/vuln/WPSEC-2026-1978/
- https://plugins.svn.wordpress.org/anti-spam/tags/7.5.5/
- https://wordpress.org/plugins/anti-spam/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS