Live › vulnerability › CVE-2026-109401
Go to dashboardThe WP Mail Logging plugin up to and including 1.17.0 mishandles the email_address parameter in its privacy export, so a LIKE wildcard in an address matches other users' logged mail. An authenticated administrator-level attacker can extract those rows, including recipient addresses, subjects, message bodies and URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running WP Mail Logging at version 1.17.0 or earlier that store mail logs and let administrators process privacy export requests. Exposure needs an attacker with administrator-level access and an address containing a wildcard character that matches another user's logged address. Sites without the plugin, or running a newer version, can skip it.
No product ranges from the sources yet.
wp plugin get wp-mail-logging --field=versionwp plugin is-active wp-mail-logging1.17.0; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
This page as .md · .json · in your agent: get_signal("CVE-2026-109401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.