WP Debugging

WP Debugging has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 3 issues recorded for WP Debugging has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. WP Debugging is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all WP Debugging vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8

WP Debugging <= 2.11.7 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

3 records
WP Debugging banner
Latestv2.12.6

WP Debugging

Andy Fragen

Author

Andy Fragen

5.0(21)
100/100
Last Updated
2026-08-13 (1mo ago)
Active Installs
10,000+
Downloads
491,006
Requires WP
5.2+
Requires PHP
5.6+
Tested up to
WP 7.1
Created
2019-02-03 (8y ago)

This plugin sets the following debug constants in wp-config.php on plugin activation and removes them on plugin deactivation. Any errors will result in a PHP Exception being thrown. Debug constants per Debugging in WordPress. Default settings: define( 'WP_DEBUG_LOG', true ); define( 'SCRIPT_DEBUG', true ); define( 'SAVEQUERIES', true ); @ini_set( &#8216;display_errors’, 1 ); is set when the plugin is active. WP_DEBUG is set to true when the plugin is first run, thereafter it can be turned off in the Settings. The Settings page allows the user to set the following. define( 'WP_DEBUG', true ); // Default on initial plugin installation. define( 'WP_DEBUG_DISPLAY', false ); // Default when not declared is true. define( 'WP_DISABLE_FATAL_ERROR_HANDLER', true ); // WordPress 5.2 WSOD Override. When the plugin is deactivated best efforts are made to re-add pre-existing constants to their former state. When the plugin is activated the default settings and any saved settings are restored. This plugin uses the wp-cli/wp-config-transformer command for writing constants to wp-config.php. Debug Quick Look from Andrew Norcross is included with this plugin to assist in reading the debug.log file. If you already have this plugin installed you should delete it when WP Debugging is not active. Query Monitor and Debug Bar plugins are optional dependencies to aid in debugging and troubleshooting. The notice for installation will recur 45 days after being dismissed. If you have a non-standard location for your wp-config.php file you can use the filter wp_debugging_config_path to return the file path for your installation. The filter wp_debugging_add_constants allows the user to add constants to wp-config.php. The filter returns an array where the key is the name of the constant and the value is an array of data containing the value as a string and a boolean to indicate whether or not the value should be passed without quotes. $my_constants = [ 'my_test_constant' => [ 'value' => 'abc123', 'raw' => false, ], 'another_test_constant' => [ 'value' => 'true' ], ]; The value option contains the constant’s value as a string. The raw option means that instead of placing the value inside the config as a string it will become unquoted. The default is true. Set as false for non-boolean values. Example: add_filter( 'wp_debugging_add_constants', function( $added_constants ) { $my_constants = [ 'my_test_constant' => [ 'value' => '124xyz', 'raw' => false, ], 'another_test_constant' => [ 'value' => 'true' ], ]; return array_merge( $added_constants, $my_constants ); }, 10, 1 ); This will create the following constants. define( 'MY_TEST_CONSTANT', '124xyz' ); define( 'ANOTHER_TEST_CONSTANT', true ); Development PRs are welcome against the develop branch on GitHub.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C