Privilege Escalation in WP Email Debug Plugin for WordPress

CVE-2025-5486

What is CVE-2025-5486?

The WP Email Debug plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit the absence of a capability check in the WPMDBUG_handle_settings() function. This flaw permits attackers to enable debugging features and redirect all outgoing emails to a controlled address. Furthermore, they can initiate a password reset process for administrator accounts, potentially granting the attacker unauthorized access to sensitive backend operations.

References