CVE-2026-109401
Received Received - Intake

Sensitive Information Exposure in WP Mail Logging Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-109401
EUVD
EUVD-2026-102800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
smub WP Mail Logging 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Mail Logging plugin for WordPress has a flaw where authenticated attackers with administrator access can expose sensitive email data. By using a wildcard character in their email address during a WordPress privacy export request, they can retrieve logged emails belonging to other users, including recipient addresses, subjects, full message bodies, and URLs.

Impact Analysis

If you use the WP Mail Logging plugin, an attacker with admin access could steal sensitive email data from other users, including personal or business communications. This could lead to data breaches, privacy violations, or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information. Organizations using this plugin may face compliance failures, legal penalties, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Immediately update the WP Mail Logging plugin to the latest version beyond 1.17.0 to patch the vulnerability. If updating is not possible, consider disabling the plugin until a patch is available. Review mail logs for unauthorized access and restrict administrator-level access to only necessary users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart