Live › vulnerability › CVE-2026-16648
Go to dashboardThe Drupal Mailer Plus Log module writes sensitive information into its log file. An attacker who already holds stolen credentials for remote services could read that data from the logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Mailer Plus Log module at version 1.2.7 or earlier. The exposure is the log file itself, so review who can read the server logs. Sites without this module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=mailer_plus_log or in composer.lock for drupal/mailer_plus_log1.2.7 (the sources list 1.2.7 as affected; the fixed version is unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-16648")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.