CVE-2026-9016 describes an improper output neutralization vulnerability (CWE-117) in the Debug Log Manager – Conveniently Monitor and Inspect Errors WordPress plugin, affecting all versions up to and including 2.5.0. The vulnerability exists because the `log_js_errors()` AJAX handler is registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and is gated solely by a nonce that is publicly available on every front-end page's HTML when JavaScript error logging is enabled. This lack of effective authorization allows unauthenticated attackers to inject arbitrary, attacker-controlled values into the WordPress debug log fields such as `message`, `script`, `lineNo`, `columnNo`, and `pageUrl`. Consequently, attackers can spoof error and incident records, potentially misleading administrators and obscuring real malicious activity within fabricated log noise. Exploitation requires the plugin's JavaScript error logging feature to be enabled, as the nonce is only published under that condition.

The vulnerability allows unauthenticated attackers to inject forged log entries into the WordPress debug log, which can mislead administrators by spoofing error and incident records. This can obscure real malicious activity by creating fabricated log noise, reducing the reliability of the debug log for incident triage. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the JavaScript error logging feature of the Debug Log Manager plugin to prevent the nonce from being exposed and block unauthenticated log injection. Monitoring for plugin updates or official patches is recommended.