PHP Object Injection in WP Mail Logging Plugin for WordPress

CVE-2026-2471

What is CVE-2026-2471?

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection due to unsafe deserialization of untrusted input from the email log message field. The BaseModel constructor calls maybe_unserialize() on all properties obtained from the database without proper validation, allowing unauthenticated attackers to inject malicious PHP Objects. By submitting a double-serialized payload through public forms (e.g., Contact Form 7), the injected payload may be deserialized when an admin views the logged email. Although the vulnerable software does not inherently support a PHP Object Payload (POP) chain, if additional plugins or themes with a POP chain are present, attackers could execute harmful actions like file deletion, data retrieval, or remote code execution.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References