Sensitive Information Exposure in Mail Logging & Catcher Plugin for WordPress

CVE-2026-120040

What is CVE-2026-120040?

The Mail Logging & Catcher plugin for WordPress has a security flaw that allows authenticated users with subscriber-level access or higher to access sensitive information stored in email logs. Specifically, attackers can exploit the 'message' parameter to retrieve valid administrator password-reset keys, enabling them to initiate a password reset and gain elevated privileges. The risk increases when the plugin's 'default_view_role' setting is configured to a capability accessible by low-privileged users, like 'read', instead of the default 'manage_options' which limits log access to administrators.

References