1.2.3 fixes a security bug in the plugin’s REST API. Please update as soon as you can.

What happened

All of the plugin’s REST API endpoints (under /wp-json/wpdebugtoolkit/v1/) responded to requests with no login. Each one has a permission check that’s meant to require a logged-in administrator, but on a failed check it returned an error response object instead of a value WordPress recognizes as a rejection. Then, WordPress read that as “allowed” and ran the endpoint anyway.

With no account, someone could:

• Read information about your site: WordPress, PHP and MySQL versions, your active plugins and their versions, plugin and debug settings, log file paths, license details, and the standalone viewer’s configuration.
• Call endpoints that change things — deactivate the license, change plugin and debug settings, or change the viewer’s setup.

Am I affected?

Yes, every version before 1.2.3. We haven’t seen any sign the bug was used, but we can’t rule it out, so update now.

How this happened

Every endpoint uses one shared permission check, so authentication is defined in a single place instead of being repeated on every route. We designed that as a strength, but it cut both ways here: one wrong return value exposed every endpoint at once — now that it’s fixed, the same design meant the fix was a single line that closed all of them at once.

We added tests that send unauthenticated requests to the endpoints and confirm they’re rejected, and we reviewed the rest of the plugin for the same kind of mistake.

Reporting security issues

This was reported on July 4, 2026, by a user via Support. We want to thank them for a clear, detailed report that helped us find and fix it quickly.

We’re always glad to get these and try to respond and patch quickly. If you find anything, please report it, and we’ll take care of it promptly.