What is the CVSS score of CVE-2026-2471?

CVE-2026-2471 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-2471?

The WP Mail Logging plugin contains a critical vulnerability allowing unauthenticated attackers to inject malicious PHP code through public-facing forms, potentially leading to complete server…

How to fix or mitigate CVE-2026-2471?

Within 24 hours: Identify all WordPress instances using WP Mail Logging and document their versions; disable the plugin immediately as a precaution. Within 7 days: Audit server logs and database for signs of exploitation; consider engaging forensics if compromise is suspected. Within 30 days: Monitor vendor for patch release; evaluate alternative email logging solutions; implement Web Application Firewall rules to block serialized object payloads if the plugin cannot be disabled.

PHP CVE-2026-2471

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-02-28 security@wordfence.com

WordPress PHP Deserialization

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 28, 2026 - 07:15 nvd

HIGH 7.5

DescriptionCVE.org

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybe_unserialize() on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

AnalysisAI

Unauthenticated attackers can inject malicious serialized PHP objects into the WP Mail Logging plugin (versions up to 1.15.0) through email forms, exploiting unsafe deserialization in the BaseModel class. When administrators view the logged emails, the injected payload deserializes into arbitrary PHP objects, potentially enabling code execution if leveraged with gadget chains from other installed plugins or themes. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-502: Deserialization of Untrusted Data) affects WP Mail Logging (WordPress plugin). The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the BaseModel class constructor calling maybe_unserialize() on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that send