CVE-2026-119273: BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security Log
The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
Affected deployments are those where BulletProof Security security log files are reachable because the plugin's expected access controls are not enforced by the web-server configuration. The issue applies to plugin versions through 7.2.
What does an attacker need to exploit this issue?
No authentication is required. An attacker needs access to a deployment where the security log files can be read through the web server.
What information could be exposed?
The exposed logs can contain logged request data, including sensitive authentication material. The specific contents depend on what requests the affected site has recorded in its security logs.