wp-flexible-shipping-log: WordPress Flexible Shipping - Log File Exposure

2026-01-08 WordPress Flexible Shipping PoC Public

Description

Detected exposed log files generated by the Flexible Shipping (flexible-shipping) plugin via WooCommerce logging (wc_get_logger).

PoC

id: wp-flexible-shipping-log

info:
  name: WordPress Flexible Shipping - Log File Exposure
  author: DhiyaneshDk
  severity: medium
  description: |
    Detected exposed log files generated by the Flexible Shipping (flexible-shipping) plugin via WooCommerce logging (wc_get_logger).
  reference:
    - https://octolize.com/docs/article/flexible-shipping-debug-mode/
    - https://octolize.com/docs/article/woocommerce-shipping-debug-mode/
  metadata:
    verified: true
    max-request: 1
  tags: wordpress,wp,wp-plugin,flexible-shipping,log,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/wpdesk-logs/wpdesk_debug.log"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "wpdesk.DEBUG","Sender payload")'
        condition: and
# digest: 4b0a00483046022100da4c710427d318938979d658c57ef20ecf5812492e120eba0a0842e0bf404ea60221009f827fb5b155f596f38ad2a13dbfed33d991072c607a08a172fe086d61e17998:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/logs/wp-flexible-shipping-log.yaml

References

Related Vulnerabilities