What is the CVSS score of CVE-2026-32538?

CVE-2026-32538 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Smtp Mailer are affected by CVE-2026-32538?

CVE-2026-32538 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-32538?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Smtp Mailer CVE-2026-32538

EUVD-2026-15912 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-03-25 Patchstack

GHSA-pg38-rrrw-whrq

WordPress Information Disclosure Smtp Mailer Wordpress Plugin Noor Alam

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15912

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through <= 1.1.24.

AnalysisAI

The SMTP Mailer plugin for WordPress (versions up to 1.1.24) contains an Insertion of Sensitive Information Into Sent Data vulnerability that allows attackers to retrieve embedded sensitive data through the plugin's email transmission functionality. This information disclosure flaw affects all installations of the affected SMTP Mailer versions and could expose credentials, configuration data, or other sensitive information transmitted via the plugin's SMTP implementation. No CVSS score or EPSS data is currently available, and no indication of active exploitation or public proof-of-concept has been documented at this time.

Technical ContextAI

The vulnerability resides in the Noor Alam SMTP Mailer WordPress plugin (identified via CPE: cpe:2.3:a:noor_alam:smtp_mailer:*:*:*:*:*:*:*:*), which provides SMTP email functionality for WordPress installations. The root cause is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that the plugin improperly handles sensitive information during email composition or transmission. Rather than a network protocol flaw in SMTP itself, this vulnerability stems from the plugin's implementation allowing sensitive data (such as API keys, authentication tokens, database credentials, or user information) to be inadvertently included in email headers, bodies, or logging mechanisms where it can be accessed by attackers or exposed through data interception.

RemediationAI

Upgrade the SMTP Mailer plugin to a version newer than 1.1.24 immediately upon availability of a security patch, as the vendor (Noor Alam) has been notified via Patchstack. Until a patched version is released, disable the SMTP Mailer plugin and revert to WordPress's native mail functionality or switch to a security-audited alternative mail plugin such as WP Mail SMTP or Postman SMTP. If the plugin must remain active, implement strict email logging controls to ensure sensitive data is never logged or cached, configure the WordPress installation to send emails only over encrypted channels (TLS/SSL), and restrict plugin access to trusted administrator accounts only. Monitor the Patchstack advisory page regularly for patch release announcements and test patches in a staging environment before production deployment.