Drupal Mailer Plus Log CVE-2026-16648

Exploitation requires the Mailer Plus Log module (any version below 1.2.7) to be installed on a Drupal site, plus possession of high-privilege/authenticated credentials (PR:H) able to reach the module's logging functionality - the description's 'Remote Services with Stolen Credentials' indicates an authenticated, high-privilege actor rather than an anonymous one. The limiting factors are therefore: the module must be deployed, and the attacker must already hold or steal high-privilege credentials; there is no user-interaction requirement (UI:N), and the impact is confined to disclosure of whatever sensitive information the module writes into its log files. The exact sensitive values logged and the specific operation that writes them are not described in the available sources.

All signals converge on low real-world priority. The CVSS 3.1 base score is only 3.8 (Low), and the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) shows that although the module is reachable over the network, exploitation requires high privileges (PR:H) - consistent with the description's 'Remote Services with Stolen Credentials' framing, i.e. an already-authenticated high-privilege actor. EPSS is 0.15% (4th percentile), among the lowest tiers, indicating negligible modeled exploitation likelihood. The vulnerability is NOT on the CISA KEV list, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all of which agree with the vuln.today 'monitor' decision label rather than any act-now posture. No public exploit identified at time of analysis; the two references are advisories (Drupal SA and NVD), not proof-of-concept code. One minor tension worth noting: the input vector lists I:L (partial integrity impact), but the weakness (CWE-532, insertion of sensitive information into a log file) is fundamentally a confidentiality/information-disclosure issue, so the integrity rating is questionable and the practical impact is disclosure of data written to logs. Overall this is a genuinely low-risk, low-severity issue, not a high-CVSS-but-overstated case.

An actor who already holds high-privilege credentials for the Drupal site (or has stolen them) accesses the Mailer Plus Log module and reads log files that the module populated with sensitive information. No public exploit code exists, and because exploitation presupposes high-privilege access the realistic scenario is an insider or a credential-theft follow-on rather than opportunistic remote compromise.