PT-2025-24077 · WordPress · Simple History

Blair Crawford · Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-5760

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Simple History plugin for WordPress versions prior to 5.8.1

Description The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context() function when Detective Mode is enabled. This allows the plugin's logger to capture the entire contents of $ POST, and sometimes raw request bodies or $ GET, without redacting any password-related keys. As a result, user passwords are written in clear text into the logs whenever a login form is submitted. This affects both authenticated attackers and users whose actions generate a login event, allowing administrators or those with database read access to retrieve the captured passwords.

Recommendations For versions prior to 5.8.1, update to version 5.8.1 or later to resolve the issue. As a temporary workaround, consider disabling Detective Mode until a patch is available. Restrict access to the logs to minimize the risk of password exposure.

Fix

Weakness Enumeration

CWE-256

Related Identifiers

CVE-2025-5760

Affected Products

Simple History

References · 10

• https://osv.dev/vulnerability/CVE-2025-5760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5760 · Security Note
• https://github.com/bonny/WordPress-Simple-History/commit/68eab0cab6882eafef4bfece884093eeda5ac018 · Note
• https://github.com/bonny/WordPress-Simple-History/issues/546 · Note
• https://simple-history.com/support/detective-mode · Note
• https://wordpress.org/plugins/simple-history/#developers · Note
• https://wordpress.org/support/topic/security-vulnerability-passwords-stored-as-plain-text-in-logs · Note
• https://plugins.trac.wordpress.org/changeset/3267487 · Note
• https://twitter.com/CVEnew/status/1930950443024167177 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b6364415-da02-4236-b635-d8fbd27faa33?source=cve · Note