Read the docs
TI-2026-75268 Aliases CVE-2026-109401GHSA-wv84-f6wm-rwxx

WP Mail Logging Sensitive Information Exposure via LIKE Wildcard in Data Export

Priority LOW 14CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

WP Mail Logging for WordPress, in all versions through 1.17.0, has a sensitive information exposure flaw (CWE-200) in the 'email_address' parameter. An authenticated attacker with Administrator access or higher can extract other users' mail log rows, including recipient addresses, subjects, message bodies and URLs, when the attacker's address contains a LIKE wildcard such as an underscore that matches them. An administrator must process a personal-data export request for that address. CVSS 3.1 base score 2.7 (Low); CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
smubWP Mail Loggingup to 1.17.0—No fix listedCNA
  • WP Mail Logging Vendorsmub Affected up to 1.17.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for WP Mail Logging 1.17.0 and earlier. Until a fix is released, limit Administrator accounts to trusted users and check personal-data export requests before an administrator processes them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-109401
  2. 2026-10-16 Alias added: GHSA-wv84-f6wm-rwxx

References

Other 6

  • TI-2026-07755 WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost CVSS 3.1HIGH 8.8
  • TI-2026-83530 Remote code execution in NextGEN Gallery plugin for WordPress CVSS 3.1HIGH 8.8
  • TI-2026-78567 PHP object injection in Duplicator and Duplicator Pro plugins CVSS 3.1HIGH 8.8
  • TI-2026-01649 ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation CVSS 3.1HIGH 8.8
  • TI-2026-01160 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion CVSS 3.1HIGH 8.8
  • TI-2025-12465 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated… CVSS 3.1HIGH 8.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences