CVE-2026-120040 in Mail Logging & Catcher Plugin
Summary
by MITRE • 10/31/2026
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in the Mail logging and Catcher plugin for WordPress, specifically affecting versions up to 2.2.0, represents a critical flaw in how sensitive authentication data is handled within the application's logging mechanism. This issue falls under the category of Sensitive Information Exposure, which corresponds to CWE-209 in the Common Weakness Enumeration standard. The core technical flaw lies in the improper handling of the 'message' parameter during the email capture and storage process. When emails are processed by the plugin, they are stored in a database or file system for later review. However, the implementation fails to sanitize or mask critical security tokens contained within these messages before persistence. Specifically, WordPress password-reset keys, which are unique cryptographic strings generated to allow users to reset their passwords securely, are written into the log entries without any form of obfuscation or encryption. This results in plaintext storage of credentials that should be treated as highly sensitive secret material.
The operational impact of this vulnerability is severe because it facilitates a direct privilege escalation attack path from low-privileged accounts to administrative control over the WordPress installation. While exploitation requires an initial foothold, the barrier to entry is significantly lowered by the plugin's configuration defaults. An attacker with subscriber-level access or higher can exploit this flaw if the administrator has configured the 'default_view_role' setting to a capability that includes lower-tier users, such as 'read'. In many standard installations where administrators wish to allow editors or authors to view logs for troubleshooting purposes, this default is often set permissively. Consequently, an authenticated attacker with minimal privileges can navigate to the log viewing interface and inspect stored email messages. By locating password-reset emails sent by WordPress itself, the attacker extracts the valid reset key embedded within the message body.
Once the attacker possesses a valid administrator password-reset key, they can proceed to complete the standard WordPress password-reset flow. This process involves navigating to the login page, selecting the forgot password option, and entering their username along with the stolen reset key. Upon successful validation of this token by the WordPress core authentication system, the attacker is granted access to set a new administrator password. This effectively bypasses all other security controls because it relies on the legitimate cryptographic verification mechanism provided by the CMS itself. The attack chain demonstrates how misconfiguration combined with poor data handling can lead to complete compromise of administrative privileges. From this point, an attacker could install malicious plugins, modify site content, exfiltrate database contents, or use the compromised account as a pivot point for further attacks against the underlying server infrastructure.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts and Default Credentials, as it involves using legitimate credentials obtained through information leakage to gain unauthorized access. It also relates to CWE-532 regarding Information Exposure Through Log Files, although in this case the exposure is due to insufficient sanitization of specific sensitive fields rather than general log verbosity. The risk is exacerbated by the fact that password-reset keys are designed for temporary use but remain valid until used or expired, providing a window of opportunity for exploitation even after the initial breach attempt has been detected and mitigated elsewhere in the security perimeter.
To mitigate this vulnerability, immediate action must be taken to address both the software version and its configuration settings. The most effective remediation is to upgrade the Mail logging and Catcher plugin to a version later than 2.2.0 where the developers have presumably implemented proper sanitization or masking of sensitive data within log entries. If upgrading is not immediately feasible, administrators should rigorously audit their WordPress configurations. Specifically, the 'default_view_role' setting must be reviewed and restricted to capabilities that are held exclusively by high-privilege users, such as 'manage_options'. This ensures that only true administrators can view email logs containing sensitive information like password-reset keys. Additionally, implementing strict access controls on any file systems or database tables storing these logs is advisable. Security teams should also consider deploying Web Application Firewalls to monitor for unusual patterns of log access and implement multi-factor authentication where possible to add a layer of defense-in-depth against credential-based attacks derived from such exposures. Regular audits of plugin configurations and adherence to the principle of least privilege are essential practices to prevent similar information disclosure vulnerabilities in WordPress environments.