Sensitive Information Exposure in Mail logging & Catcher WordPress Plugin

Executive Summary

The Mail logging & Catcher WordPress plugin up to version 2.2.0 has a flaw where authenticated users with subscriber-level access or higher can view stored email logs. If an administrator previously set the plugin's default_view_role to a low-privilege capability like 'read', attackers can extract administrator password-reset keys from these logs. This allows them to complete the WordPress password-reset process and escalate their privileges to administrator level.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress plugin logs for exposed password reset links in the 'message' parameter of the Mail logging & Catcher plugin up to version 2.2.0. Look for URLs containing 'action=rp' or 'key=' in stored email logs.

Useful 0 Not Useful 0

Impact Analysis

If you use this plugin with default settings, only administrators can access logs, so the risk is low. However, if an administrator changed the default_view_role to a lower capability, any logged-in user could exploit this to reset the admin password and take full control of your WordPress site. This could lead to site defacement, data theft, or further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

• Update the Mail logging & Catcher plugin to version 2.3.0 or later to enable automatic redaction of password reset links.
• Review and restrict the plugin's default_view_role setting to prevent low-privileged users from accessing logs.
• Manually redact any existing logs containing sensitive password reset links.

Useful 0 Not Useful 0