Privilege Escalation in Ultimate WP Mail Plugin for WordPress

CVE-2025-6993

What is CVE-2025-6993?

The Ultimate WP Mail plugin for WordPress is susceptible to a privilege escalation issue due to improper authorization in the get_email_log_details() AJAX handler. This vulnerability occurs in versions 1.0.17 to 1.3.6, allowing authenticated users with Contributor-level access and above to exploit the handler. By leveraging a client-supplied post_id, these users can access sensitive email log content, including password-reset links, as the authorization only checks for 'edit_posts' capability without validating user ownership or restricting access to administrators. This oversight enables potential attackers to retrieve an admin's reset link and gain elevated privileges.

References