PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File

This research plan targets CVE-2025-14280, a sensitive information exposure vulnerability in the PixelYourSite plugin. The vulnerability allows unauthenticated access to log files containing Meta (Facebook) API request/response data, which often includes sensitive API tokens, user PII (emails, IPs), and event details.

---

1. Vulnerability Summary

• Vulnerability: Sensitive Information Exposure via Log File.
• Root Cause: The plugin writes sensitive Meta Conversions API (CAPI) communication data to a log file located in a predictable, publicly accessible directory (wp-content/uploads/...) without adequate access controls or filename randomization.
• Precondition: The "Meta API logs" setting must be enabled. While disabled by default, it is frequently used for troubleshooting API connection issues.
• Affected Versions: <= 11.1.5.

2. Attack Vector Analysis

• Endpoint: Direct HTTP GET request to the log file URL.
• Target URL (Inferred):
  • Primary: http://localhost:8080/wp-content/uploads/pixelyoursite/logs/meta_api.log
  • Secondary: http://localhost:8080/wp-content/uploads/pys-logs/meta_api.log
• Authentication: None required.
• Payload: No specific payload; the attack is a direct file retrieval.

3. Code Flow (Inferred)

1. Enabling Logs: The admin enables "Meta API logs" in the PYS Dashboard. This sets a flag in the pys_core or pys_facebook option array in the database.
2. Triggering Logs: When a tracked event (e.g., PageView, AddToCart) occurs, the plugin sends a Conversions API request to Meta.
3. Logging Sink: If logging is enabled, the plugin calls a logging function (likely in a class like PYS_Logger or within the Facebook class) that uses file_put_contents or fopen to append data to a file.
4. Path Construction: The plugin uses wp_upload_dir() to determine the base path and appends a predictable subdirectory like pixelyoursite/logs/ and a filename like meta_api.log.
5. Access: Since the directory lacks an index.php, .htaccess (on Nginx), or a randomized filename, the log is served directly by the web server.

4. Nonce Acquisition Strategy

No nonce is required. This is a direct file access vulnerability. The attacker does not need to interact with the WordPress AJAX or REST API endpoints to read the log file.

5. Exploitation Strategy

The goal is to enable the logging feature, trigger an event, and then retrieve the log file as an unauthenticated user.

1. Locate Logging Code:
   Use the following commands to confirm the log path and setting name:

   • grep -r "meta_api.log" .
   • grep -r "meta_api_log" .
   • grep -r "wp_upload_dir" . | grep "log"

2. Enable Logging (Simulation):
   The setting is likely stored in the pys_core option. Use WP-CLI to enable it:

   # Note: The exact option key might be 'pys_core' or 'pys_facebook'
   # and the sub-key might be 'meta_api_log_enabled' or similar.
   # Verification of option name is part of the research.
   wp option get pys_core
   

3. Generate a Tracking Event:
   Visit the homepage. PixelYourSite automatically triggers a PageView event for Meta CAPI if configured.

   // Using browser_navigate to trigger the event
   await browser_navigate("http://localhost:8080/");
   

4. Retrieve the Log File:
   Perform an unauthenticated GET request to the identified log path.

   # Target URL based on standard PYS structure
   GET /wp-content/uploads/pixelyoursite/logs/meta_api.log
   

6. Test Data Setup

1. Install Plugin: Ensure PixelYourSite version 11.1.5 or lower is installed.
2. Configure Facebook Pixel: A dummy Pixel ID and API Token must be set in the PYS settings for the plugin to attempt CAPI requests.

   # Example (Verify exact option structure first):
   wp option patch insert pys_facebook pixel_id "123456789"
   wp option patch insert pys_facebook capi_token "EAAG..."
   wp option patch insert pys_facebook capi_enabled true
   wp option patch insert pys_facebook meta_api_log_enabled true
   

3. Verify Directory: Confirm the directory exists.

   ls -la /var/www/html/wp-content/uploads/pixelyoursite/logs/
   

7. Expected Results

• The http_request to the log file should return an HTTP 200 OK status.
• The response body should contain JSON or raw text logs starting with timestamps.
• Sensitive keys like "access_token", "event_name", "user_data", and "client_user_agent" should be visible in the log.

8. Verification Steps

1. Check Log Content:

   # Check the file content directly in the container to verify what WAS exposed
   cat /var/www/html/wp-content/uploads/pixelyoursite/logs/meta_api.log
   

2. Compare with Exploit Output: Verify that the data retrieved via http_request matches the file on disk.
3. Confirm Unauthenticated Access: Ensure the http_request tool is not sending any session cookies when fetching the log.

9. Alternative Approaches

• Filename Brute Force: If meta_api.log is not found, check if the plugin uses timestamped logs (e.g., meta_api-2023-10-27.log).
• Directory Indexing: If the server is misconfigured to allow directory listing, try accessing /wp-content/uploads/pixelyoursite/logs/ directly to see all log files.
• Other Log Files: Look for pys.log, facebook.log, or google_analytics.log in the same directory, as the plugin supports multiple tags.

Research Grep Cheat Sheet

# Find where the plugin defines the log path
grep -rn "get_upload_path" .
grep -rn "get_upload_url" .

# Find the specific string for the Meta API log file
grep -rn "meta_api" . | grep ".log"

# Find the logic that checks if logging is enabled
grep -rn "meta_api_log_enabled" .