The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0…
CVE-2026-120040
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's defaultviewrole setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manageoptions' restricts log access to administrators only.
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 31 October 2026
- Last updated
- 31 October 2026
- Affected
- wardee
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/599e46ed-a71c-41d1-839f-6bb76808a58f?source=cve
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L259
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L101
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Loggers/WpMail.php#L42
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/TextMessage.php#L10
- https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/HtmlMessage.php#L9
- https://github.com/JWardee/wp-mail-catcher/releases/tag/v2.3.0
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-120040