{"id":"CVE-2025-5760","aliases":["EUVD-2025-17112","GHSA-q2wh-799f-g8x3"],"status":"published","title":"Simple History \u003c= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00467,"percentile":0.40779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-256"],"published":"2025-06-06T11:13:16Z","modified":"2026-10-28T02:30:33Z","products":[{"vendor":"eskapism","product":"simple history – track, log, and audit wordpress changes"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6364415-da02-4236-b635-d8fbd27faa33?source=cve","tags":["web"]},{"url":"https://simple-history.com/support/detective-mode/","tags":["web"]},{"url":"https://wordpress.org/plugins/simple-history/#developers","tags":["web"]},{"url":"https://github.com/bonny/WordPress-Simple-History/issues/546","tags":["report"]},{"url":"https://github.com/bonny/WordPress-Simple-History/commit/68eab0cab6882eafef4bfece884093eeda5ac018","tags":["fix"]},{"url":"https://wordpress.org/support/topic/security-vulnerability-passwords-stored-as-plain-text-in-logs/","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/changeset/3267487/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5760","tags":["advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3267487"},{"url":"https://simple-history.com/support/detective-mode"},{"url":"https://wordpress.org/support/topic/security-vulnerability-passwords-stored-as-plain-text-in-logs"},{"url":"https://github.com/advisories/GHSA-q2wh-799f-g8x3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5760.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5760","title":"Simple History \u003c= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","status":"published","published":"2025-06-06T11:13:16.129Z","modified":"2026-04-08T17:17:22.668Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:32:29.97618Z"}],"euvd":[{"id":"EUVD-2025-17112","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","status":"published","published":"2025-06-06T11:13:16Z","modified":"2026-04-08T17:17:22Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:43.773985Z"}],"ghsa":[{"id":"GHSA-q2wh-799f-g8x3","title":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective...","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","status":"published","published":"2025-06-06T12:30:33Z","modified":"2025-06-06T12:30:44Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T15:02:36.179759Z"}],"nvd":[{"id":"CVE-2025-5760","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","status":"published","published":"2025-06-06T12:15:25.333Z","modified":"2026-06-17T09:48:42.517Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:11:10.8732Z"}],"osv":[{"id":"CVE-2025-5760","title":"Simple History \u003c= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode","description":"The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.","status":"published","published":"2025-06-06T11:13:16.129Z","modified":"2026-10-28T02:30:33.202559992Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T15:44:51.190588Z"}]}}