CVE-2026-109401

01/תיאור (מקור, אנגלית)

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

02/קישורים6

• plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.17.0‮…
• plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.17.0‮…
• plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.17.0‮…
• plugins.trac.wordpress.org/changeset/3746095/wp-mail-logging/t‮…
• plugins.trac.wordpress.org/changeset?reponame=&new=3746095%40w‮…
• www.wordfence.com/threat-intel/vulnerabilities/id/f2b96f36-090‮…