# Titan Anti-spam & Security <= 7.5.4 - Unauthenticated Sensitive Information Exposure via Debug Log Export

- **ID:** WPSEC-2026-1978
- **Plugin:** Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter (`anti-spam`), https://wordpress.org/plugins/anti-spam/
- **Affected versions:** from 7.5.0 before 7.5.5
- **Fixed in:** 7.5.5 (Update to 7.5.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/anti-spam
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1978/

## Description

The Titan Anti-spam & Security plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log export feature in all versions up to, and including, 7.5.4. This is due to the export ZIP archive, which contains the plugin's logs and system information, being written to the public uploads directory under a predictable date-based filename (titan_debug_report-YYYY-MM-DD.zip) and never being removed. This makes it possible for unauthenticated attackers to download the archive and read potentially sensitive log and system data after an administrator has exported the logs.

## References

- https://wpsec.com/vuln/WPSEC-2026-1978/
- https://plugins.svn.wordpress.org/anti-spam/tags/7.5.5/
- https://wordpress.org/plugins/anti-spam/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1978/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.