Sensitive Information Exposure in WP Mail Logging Plugin for WordPress

CVE-2026-109401

What is CVE-2026-109401?

The WP Mail Logging plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator-level access to exploit the 'email_address' parameter. This flaw enables them to access logged emails of other users, potentially exposing sensitive information like recipient addresses, message subjects, and full content of emails. Attackers must initiate a personal-data export request for their own email address using a wildcard character, which can match other user addresses in the mail log, thereby facilitating unauthorized information retrieval.

References