CVE-2025-5760 json
Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode
published 2025-06-06 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-17112
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
Patch / fix
- simple-history simple_history 5.8.2
- simple_history_project simple_history 5.8.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected products
- eskapism Simple History – Track, Log, and Audit WordPress Changes
Classification
- Weakness
-
- CWE-256 Plaintext Storage of a Password
- Technology feeds
References
- github.com /bonny/WordPress-Simple-History/commit/68eab0cab6882eafef4bfece884093eeda5ac018
- wordfence.com /threat-intel/vulnerabilities/id/b6364415-da02-4236-b635-d8fbd27faa33?source=cve
- simple-history.com /support/detective-mode/
- wordpress.org /plugins/simple-history/#developers
- github.com /bonny/WordPress-Simple-History/issues/546
- wordpress.org /support/topic/security-vulnerability-passwords-stored-as-plain-text-in-logs/
- plugins.trac.wordpress.org /changeset/3267487/
Sources
- CVE List CVE-2025-5760
- NVD CVE-2025-5760
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.