CVE-2026-109401

CVE-2026-109401 · WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

CVSS 2.7 · Faible · EPSS 0,3%

Publication

2026-10-16T06:41:07.717Z

Mise à jour

2026-10-16T14:21:19.789Z

Vérifiez votre serveur →