Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: WP Mail Log 1.1.3 Clear all filters
TI-2023-05215 CVE-2023-5672 · GHSA-pq3w-qg2x-wx83

WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint

Priority MEDIUM 62

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary fi…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00707 Published 2023-12-26 Fixed in 1.1.3 CWE-22
TI-2023-05195 CVE-2023-5644 · GHSA-44wj-8576-vhvg

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

Priority HIGH 68

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00499 Published 2023-12-26 Fixed in 1.1.3 CWE-863
TI-2023-05196 CVE-2023-5645 · GHSA-7xf3-8mxm-8vxc

WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint

Priority LOW 39

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00721 Published 2023-12-26 Fixed in 1.1.3 CWE-89
TI-2023-05216 CVE-2023-5673 · GHSA-rxww-qvhg-88h2

WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE

Priority MEDIUM 40

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01096 Published 2023-12-26 Fixed in 1.1.3 CWE-434
TI-2023-05217 CVE-2023-5674 · GHSA-gh6q-hg4q-mm5j

WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint

Priority MEDIUM 51

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.10826 Published 2023-12-26 Fixed in 1.1.3 CWE-89