Description

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

Quick Facts

References

• https://plugins.trac.wordpress.org/browser/wp-mail-logging/t…
• https://plugins.trac.wordpress.org/browser/wp-mail-logging/t…
• https://plugins.trac.wordpress.org/browser/wp-mail-logging/t…
• https://plugins.trac.wordpress.org/changeset/3746095/wp-mail…
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3…
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f2…

External Resources