Live › vulnerability › CVE-2026-120040
The Mail logging & Catcher plugin for WordPress up to and including 2.2.0 leaks stored email logs through its 'message' parameter. An authenticated subscriber can pull valid administrator password-reset keys and reset the admin password, gaining administrator access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Mail logging & Catcher plugin at 2.2.0 or earlier where an administrator changed default_view_role to a capability held by low-privilege users such as 'read'. On an untouched install the default 'manage_options' limits log access to administrators, so the default configuration is not exposed. Any subscriber-level account on an affected site is enough to start the attack.
No product ranges from the sources yet.
wp-content/plugins/default_view_role setting; exposure needs it set to a low-privilege capability such as read2.2.0; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
This page as .md · .json · in your agent: get_signal("CVE-2026-120040")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.