WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

CVE-2023-5644

Summary

The WP Mail Log plugin for WordPress prior to version 1.1.3 has a security vulnerability that inadequately restricts access to its REST API endpoints. This flaw allows users with Contributor roles to access and modify data that should be reserved for Admin users. Consequently, unauthorized individuals may view or delete sensitive information, leading to potential data breaches and further exploitation of the site. It is critical for users of the plugin to update to the latest version to mitigate this security risk and protect their WordPress installations.

References