CVE-2026-9016

An unauthenticated attacker can exploit this vulnerability by sending a crafted POST request to the `log_js_errors()` AJAX handler. This handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and is protected by a nonce that is publicly exposed in the HTML of any front-end page when JavaScript error logging is enabled. The attacker can supply arbitrary values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields to inject forged entries into the site's debug log. This attack is only possible if the plugin's JavaScript error logging feature is enabled [ref_id=1].

The vulnerability lies within the `log_js_errors()` method, which is registered as an AJAX handler for unauthenticated users. This method is accessible via the `wp_ajax_nopriv_log_js_errors` hook. The lack of proper authorization checks before nonce verification allows unauthenticated users to inject malicious data into the debug logs [ref_id=1].

The patch addresses the vulnerability by ensuring that the `log_js_errors()` AJAX action is properly checked for user authentication. Specifically, it adds a check to verify if the current user has the 'manage_options' capability before proceeding with the nonce verification and log entry creation. This prevents unauthenticated users from accessing and exploiting the AJAX handler, thereby mitigating the risk of arbitrary log injection.