WP Mail Catcher CVE-2026-93889

Exploitation is NOT possible against a default standalone install: it requires (1) a separately installed plugin such as Contact Form 7 that passes unauthenticated, user-controlled input into WordPress mail fields, and (2) the outgoing mail to actually FAIL, so PHPMailer generates a 'wp_mail_failed' error message that embeds the attacker's input. WP Mail Catcher (≤2.1.12) then stores that message without sufficient sanitization/output escaping. The payload only fires when a user - realistically a logged-in administrator - opens the plugin's mail log view in wp-admin, so the practical trigger depends on an admin viewing the log. Limiting factors: the dependency on a second input-forwarding plugin, the need for a mail-send failure, and the requirement that a privileged user view the log page.

This is a genuine but conditional, mid-tier risk rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) advertises unauthenticated network exploitation with a scope change, which looks alarming, but the description itself undercuts the AC:L/UI:N optimism: successful exploitation requires a SEPARATE plugin (e.g., Contact Form 7) that pipes unauthenticated user input into mail fields AND requires that mail to actually fail so PHPMailer builds a 'wp_mail_failed' error message containing the payload. That is a meaningful real-world precondition the base vector does not reflect, so AC:L is arguably optimistic (see assessed vector below). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable exploitation - only a Wordfence-reported vulnerability with source-code references. The signals are therefore internally consistent in one respect (a real stored-XSS sink exists, confirmed by the linked plugin source) but the headline severity overstates practical exploitability because of the required plugin chain and mail-failure condition. Treat as a standard patch-on-cycle item for sites running this plugin alongside a form plugin, not a drop-everything issue.

An attacker submits a contact form (served by a secondary plugin such as Contact Form 7) with a malicious JavaScript payload placed in a field that becomes part of the outgoing email; when the mail send fails, PHPMailer embeds the attacker-controlled content in its 'wp_mail_failed' error message, which WP Mail Catcher stores unsanitized. When an administrator later opens the mail log in wp-admin, the stored script executes in their authenticated browser session. No public exploit code was identified at time of analysis, and the chain depends on a mail failure occurring.