{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119273", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-29T18:32:17.436Z", "datePublished": "2026-11-10T06:00:04.617Z", "dateUpdated": "2026-11-10T06:00:04.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-10T06:00:04.617Z"}, "title": "BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security Log", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "BulletProof Security", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "7.2"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments."}], "references": [{"url": "https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Charles Vosburgh", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "BulletProof Security", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments."}], "id": "CVE-2026-119273", "lastModified": "2026-11-10T16:28:46.510", "metrics": {}, "published": "2026-11-10T06:17:08.080", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/15f56343-f2b3-461c-b40d-50f881944111/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred"}

{}

{}