CVE-2026-109401: WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email

Vulnerability summary

CVE-2026-109401 is a low (CVSS 2.7) vulnerability in smub wp mail logging. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.1% of scored vulnerabilities.

Timeline

1. 16-10-2026
   PublishedVulnerability first disclosed.
2. 16-10-2026
   Last modifiedVulnerability information updated.

Description

The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.