{"id":"CVE-2026-109401","kind":"vulnerability","aliases":["CVE-2026-109401"],"related":[],"title":"WP Mail Logging WordPress plugin leaks other users' mail logs via wildcard","description":"The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.","summary":"The WP Mail Logging plugin up to and including 1.17.0 mishandles the email_address parameter in its privacy export, so a LIKE wildcard in an address matches other users' logged mail. An authenticated administrator-level attacker can extract those rows, including recipient addresses, subjects, message bodies and URLs.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-mail-logging"],"not_affected_if":["no-admin-users","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of WP Mail Logging in the WordPress plugins screen or `wp plugin get wp-mail-logging --field=version`\n- Confirm whether the plugin is active with `wp plugin is-active wp-mail-logging`","fix":"- Update WP Mail Logging to a version later than `1.17.0`; the fixed version is unknown from the sources\n- Until patched, deactivate the plugin or limit who can process personal-data export requests","status":"open","published_at":"2026-10-16T07:17:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:48:10+00:00","updated_at":"2026-10-25T04:48:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:48:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Mail Logging to a version later than `1.17.0`; the fixed version is unknown from the sources\n- Until patched, deactivate the plugin or limit who can process personal-data export requests","reach":"internet","title":"WP Mail Logging WordPress plugin leaks other users' mail logs via wildcard","impact":"medium","summary":"The WP Mail Logging plugin up to and including 1.17.0 mishandles the email_address parameter in its privacy export, so a LIKE wildcard in an address matches other users' logged mail. An authenticated administrator-level attacker can extract those rows, including recipient addresses, subjects, message bodies and URLs.","category":"package","nicknames":[],"who_cares":["wordpress","wp-mail-logging","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads other users' mail logs, including message bodies and URLs","analyst_note":"","how_to_check":"- Check the installed version of WP Mail Logging in the WordPress plugins screen or `wp plugin get wp-mail-logging --field=version`\n- Confirm whether the plugin is active with `wp plugin is-active wp-mail-logging`","needs_analyst":false,"not_affected_if":["plugin-not-installed","patched-version","no-admin-users"],"who_is_affected":"WordPress sites running WP Mail Logging at version 1.17.0 or earlier that store mail logs and let administrators process privacy export requests. Exposure needs an attacker with administrator-level access and an address containing a wildcard character that matches another user's logged address. Sites without the plugin, or running a newer version, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000652,"input_tokens":3461,"output_tokens":612,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-109401':15A,18A '-2026':14A,17A '1.17.0':37B,97C 'access':114C 'address':41B,53B,71B,101C,129C,141C,164C,175C,194C 'administr':62B,112C,150C 'administrator-level':61B,111C 'attack':64B,109C,161C,173C 'authent':60B,108C 'belong':123C 'bodi':74B,134C 'charact':181C 'complet':119C 'contain':138C,177C 'cve':13A,16A 'data':156C 'email':40B,100C,163C 'exploit':147C 'export':46B,157C 'exposur':89C 'extract':66B,118C 'full':132C 'happen':142C 'host':22B 'includ':36B,69B,96C,127C 'inform':88C 'leak':6A 'least':189C 'level':63B,113C 'like':49B,179C 'log':3A,10A,27B,31B,57B,80C,120C,198C 'mail':2A,9A,26B,30B,58B,79C,121C,197C 'make':104C 'match':54B,144C,187C 'messag':73B,130C,133C 'mishandl':38B 'must':176C 'one':190C 'packag':19B 'paramet':42B,102C 'person':155C 'personal-data':154C 'plugin':5A,32B,81C 'possibl':106C 'privaci':45B,169C 'process':152C 'recipi':70B,128C 'request':158C 'requir':148C 'row':68B,122C 'self':21B 'self-host':20B 'sensit':87C 'standard':167C 'subject':72B,131C 'therein':139C 'underscor':185C 'url':76B,137C 'user':8A,56B,126C,192C 'version':92C 'via':11A,98C,165C 'vulner':85C 'whose':140C 'wildcard':12A,50B,146C,180C 'wordpress':4A,23B,83C,168C 'workflow':170C 'wp':1A,25B,29B,78C 'wp-mail-log':24B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WP Mail Logging at version 1.17.0 or earlier that store mail logs and let administrators process privacy export requests. Exposure needs an attacker with administrator-level access and an address containing a wildcard character that matches another user's logged address. Sites without the plugin, or running a newer version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109401","severity":null,"published_at":"2026-10-16T07:17:09+00:00","modified_at":"2026-10-16T15:17:07+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}