CVE-2023-6383 is a high severity flaw in the Debug Log Manager plugin for WordPress. Before version 2.3.0, a directory listing weakness lets anyone download the debug log without authorisation, and logs can hold sensitive data. Update to 2.3.0 or later.
What's affected
- Product: Debug Log Manager, a WordPress plugin.
- Affected: versions before 2.3.0, per the record.
- Fixed: 2.3.0.
- Exposure: an unauthenticated visitor can fetch the debug log, according to the record.
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
Also check whether a log file from this plugin is reachable. From a machine outside your network, request the log location with a browser or curl and see whether it returns content. If it does, treat the log as disclosed.
What to do now
- Update Debug Log Manager to 2.3.0 or later.
- Read the existing debug log for secrets such as tokens, paths, email addresses and database errors, and rotate anything sensitive.
- Turn debug logging off on production sites once you are done with it.
- Block direct web access to log directories at the web server.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-862 (Missing Authorization): The code does not check whether the caller is allowed to perform the action or see the data.
The record classes the weakness as missing authorization. The log is stored where the web server can serve it, and nothing asks who is requesting it. Debug logs are written for developers and often include file paths, SQL errors, request data and sometimes credentials.
Nothing here needs an exploit. A visitor fetches a file. That is why the base score is high on confidentiality even though the vector shows no integrity or availability impact. After patching, assume the log contents may have been read and rotate secrets found in it.
Try it yourself
This walkthrough shows how a finding moves from detection to a tracked fix, which is the path this plugin update should follow in your own inventory.
Click through it at your own pace, or open it full screen.
Quick check
Is updating enough?
Updating closes the exposure. If the log was reachable before, rotate any secret that appeared in it.
Does this need a login to exploit?
No. The record says the log can be downloaded without authorisation.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
