Check & Log Email CVE-2026-14554

Exploitation requires a valid WordPress administrator account (confirmed by CVSS PR:H). The Check & Log Email plugin must be installed and active on the target WordPress installation. No non-default configuration beyond plugin activation is required. Factors that limit exploitation: (1) only high-privilege admin accounts can trigger the vulnerable code paths - editor, author, or subscriber roles cannot; (2) an attacker without pre-existing admin credentials must first compromise an admin account through a separate attack vector before this vulnerability becomes reachable; (3) the plugin must be present and enabled. No unauthenticated exploitation path is indicated by the CVSS vector or description.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N reflects the genuine tension in this vulnerability: the technical impact of a successful SQL injection (full database read and write, C:H/I:H) is severe, but the PR:H constraint substantially narrows the realistic attack surface to actors who already hold WordPress admin credentials. EPSS at 0.16% (6th percentile) is consistent with this assessment and does not signal broad opportunistic scanning. No KEV listing confirms no observed mass exploitation. The public PoC via WPScan lowers the skill floor for any attacker who does obtain admin access, making this a meaningful privilege-escalation amplifier in multi-stage intrusions rather than a standalone critical entry point. For environments where multiple individuals hold admin roles, or where admin accounts are exposed to phishing, real-world priority should be elevated beyond the raw CVSS score suggests.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or a prior compromise - logs into the wp-admin backend and navigates to a parameter within the Check & Log Email plugin interface. The attacker injects a SQL payload (facilitated by the publicly available WPScan PoC) that is executed against the WordPress database, extracting hashed user passwords, email log contents, or other sensitive records, or modifying database rows to establish persistence.