Debug Assistant
Debug Assistant has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
Every one of the 2 issues recorded for Debug Assistant has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Prasanna V Balaji. Debug Assistant is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.
CVE-2023-26516Debug Assistant <= 1.4 - Cross-Site Request Forgery via imlt_create_admin
Read the full analysisVulnerability Records
Debug Assistant
Author
WPIndeed Development
A handy tool for developers and users who build plugins or themes. WORKFLOW a. The plugin allows you to edit WordPress constants only in debugging purpose b. Based on editing WordPress constants, admin users can see error logs or save it in a log file c. Plugin allows you to create temporary admin users, set cron job for them and track logged admins in real time d. Wp config file is automatically saved before editing by any admin user
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C