Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.7

WP Mail Logging lets admin view other users' email data

CVE-2026-109401 · published 2 days ago
Summary

The WP Mail Logging plugin for WordPress lets anyone with an admin account request a personal data export using a specially crafted email address. By doing so, the admin can see full email messages, subjects, recipients, and URLs that belong to other users. Limit admin access to trusted personnel or upgrade to a version where this behavior is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
smub wp mail logging <= 1.17.0
Original advisory text
WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Sources
CVE-2026-109401 · NVD
CVE-2026-109401 · MITRE
Track software like this
Free during beta