EUVD-2026-15912
GHSA-pg38-rrrw-whrq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through <= 1.1.24.
AnalysisAI
The SMTP Mailer plugin for WordPress (versions up to 1.1.24) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows attackers to retrieve embedded sensitive data through the plugin's email transmission functionality. This information disclosure flaw affects all installations of the affected SMTP Mailer versions and could expose credentials, configuration data, or other sensitive information transmitted via the plugin's SMTP implementation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit Noor Alam SMTP Mailer versions <= 1.1.24 when the application processes outbound SMTP messages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | While a CVSS score and vector are not provided for this vulnerability, the information disclosure nature and the fact that it affects a widely-deployed WordPress plugin class suggests moderate to elevated real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker monitoring SMTP traffic or accessing WordPress log files discovers that the SMTP Mailer plugin has inadvertently embedded database credentials or API keys into the headers or body of outgoing emails sent by the WordPress installation. By capturing these emails (either via MITM attack on unencrypted SMTP, by compromising a mail server, or by accessing plugin logs), the attacker gains administrative credentials or API keys that grant access to backend systems, databases, or third-party integrations. … |
| Remediation | Upgrade the SMTP Mailer plugin to a version newer than 1.1.24 immediately upon availability of a security patch, as the vendor (Noor Alam) has been notified via Patchstack. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today