CVE-2024-0866: checkemail check & log email – easy email testing & mail logging Code Injection
Vulnerability summary
CVE-2024-0866 is a high (CVSS 8.1) Code Injection vulnerability in checkemail check & log email – easy email testing & mail logging. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities. Fixed in 1.0.10.
Timeline
- 26-03-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.73% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Checkemail1 product
Wordpress1 product
- check-email≤ 1.0.9 (fixed in 1.0.10)
2 vendors · 2 products