Debug

Debug has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Debug has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nguyen Xuan Chien. Debug is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Debug vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-24798

Debug <= 1.10 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Debug banner
Latestv1.14
4.6(11)
92/100
Last Updated
2026-09-09 (2mo ago)
Active Installs
2,000+
Downloads
97,669
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2017-04-21 (10y ago)

Debug is a development and production tool that helps you find and fix bugs on your WordPress site (including multisite). It gives you a clean admin panel to toggle WordPress’s built-in debug constants, read the error log, and receive instant email notifications when meaningful errors happen — all without editing wp-config.php by hand. What it does for you One-click debug flags — toggle WP_DEBUG, WP_DEBUG_LOG, WP_DEBUG_DISPLAY, SCRIPT_DEBUG and SAVEQUERIES directly from the settings page. Error log viewer — view, clear and download the tail of your wp-content/debug.log (last 1 MB) right from the admin. Real-time email alerts — get notified when errors and warnings occur, with a throttled, level-filtered handler that ignores deprecation notices and suppressed (@) code. Safe wp-config editing — a timestamped backup is created automatically before every change, with one-click restore if you ever need to roll back. Why you can trust it The plugin never lets you download wp-config.php (a common credential leak in older debug plugins). All file access is strictly path-guarded, all admin actions are protected with nonces and capability checks, and backups let you revert any change instantly. Frequently Asked Questions Is my wp-config.php safe? Yes. The plugin creates a timestamped backup of wp-config.php before every change, and the settings page lets you restore any backup with one click. wp-config.php is never downloadable from the browser. Can I use this on a production site? Yes — and that’s a core use case. Error notifications only fire for meaningful error levels (errors and warnings), never for deprecation notices. Emails are queued and throttled so a busy site won’t flood your inbox, and WP_DEBUG_DISPLAY is kept off by default so errors are not shown to visitors. Why am I not getting email notifications? Make sure Email Notification is enabled and a valid address is set, and that wp_mail() works on your host. Only errors and warnings trigger emails (notices and deprecations are filtered out). The plugin says wp-config.php is not writable. What do I do? Check your file permissions. Most hosts run with the web user owning wp-config.php (usually 0644). If the plugin still cannot write it, it shows you the exact code to paste into wp-config.php manually — so you’re never stuck. What does “Error Log” show? It shows the last 1 MB of wp-content/debug.log, so you can inspect recent errors without loading a huge file. You can clear the log or download it as a plain text file. Does this work on multisite? Yes. All settings are stored per-site and the wp-config.php edits apply globally, which is the expected behaviour for network-wide debug toggling. Contacts For support or the development team of the Debug plugin: https://soninow.com/contact

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C