WP Mail Logging CVE-2026-1661

Requires WP Mail Logging plugin versions before 1.17.0 installed and actively logging emails on the target WordPress site, plus an attacker-reachable input path that generates a logged email (e.g., a public contact form). Exploitation only completes when a logged-in administrator opens the plugin's email log admin screen (UI:R) and is deceived by the injected styled content/link - so it depends on administrator interaction and social engineering rather than direct automated compromise. Limiting factors: impact is confined to content/link spoofing and browser redirection (no confidentiality or availability impact and no confirmed script execution), and no authentication is needed by the attacker to inject (PR:N) but a human admin viewer is mandatory.

This is a moderate, not urgent, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is low integrity (C:N/A:N) and which critically requires user interaction (UI:R) - specifically an administrator opening the email log. A public exploit exists (WPScan), so 'publicly available exploit code exists', but there is no CISA KEV listing and no EPSS score was provided, so the probability of widespread automated exploitation cannot be quantified from the input - STATE EXPLICITLY: EPSS is MISSING. The signals are internally consistent: low technical impact plus mandatory admin interaction make this a social-engineering/phishing primitive (inject deceptive styled links into a log an admin trusts), not a code-execution or data-breach bug. Note the input Tags label this 'Code Injection', but the description is HTML/CSS content injection and link spoofing with no evidence of script/code execution - treat the 'Code Injection' framing with caution and verify no stored XSS variant exists. Net: realistic priority is low-to-medium; prioritize patching but it is not a drop-everything emergency absent active exploitation evidence.

An attacker submits a public-facing contact form (or any input that triggers an outbound email) on a WordPress site running WP Mail Logging before 1.17.0, embedding attacker-controlled HTML/CSS and a disguised hyperlink. WP Mail Logging stores and later renders this content unsanitized in its admin log screen, so when an administrator reviews the email logs the deceptive content displays and a click (or styled lure) sends their browser to an attacker-controlled page. A public exploit for this technique is available via WPScan.