EUVD-2025-17069
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUG_handle_settings() function in versions 1.0 to 1.1.0. This makes it possible for unauthenticated attackers to enable debugging and send all emails to an attacker controlled address and then trigger a password reset for an administrator to gain access to an administrator account.
Analysis
The WP Email Debug WordPress plugin (versions 1.0-1.1.0) contains a critical privilege escalation vulnerability (CVE-2025-5486) stemming from missing capability checks in the WPMDBUG_handle_settings() function. Unauthenticated attackers can exploit this to modify plugin settings, redirect administrator emails to attacker-controlled addresses, and trigger password resets to gain full administrative access to affected WordPress installations. The CVSS 9.8 score reflects network-based exploitation with zero complexity and no authentication required, representing a critical severity threat with high real-world exploitation potential.
Technical Context
The vulnerability exists in the WP Email Debug plugin's WPMDBUG_handle_settings() function, which processes settings changes without validating user capabilities via WordPress' capability checking system (typically using functions like current_user_can()). This is a textbook example of CWE-862 (Missing Authorization), where an application exposes functionality that should be restricted to authenticated administrative users. The plugin likely uses WordPress AJAX handlers or admin-ajax.php endpoints to process settings modifications; the missing capability check allows unauthenticated users (or low-privilege users) to reach code that should be reserved for administrators. By manipulating plugin settings through direct function calls or AJAX requests, attackers can reconfigure email routing and enable debugging features meant only for site administrators. The attack leverages WordPress' authentication system failure rather than a cryptographic or protocol-level flaw.
Affected Products
WP Email Debug plugin for WordPress, versions 1.0 through 1.1.0 (inclusive). Affected CPE would be: cpe:2.3:a:*:wp-email-debug:*:*:*:*:*:wordpress:*:*. Specific version ranges: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0 or any patch level within these minor versions. The vulnerability affects any WordPress installation with this plugin installed and activated, regardless of WordPress core version or PHP version, as the flaw is application-level. WordPress multisite installations may face compounded risk if the plugin is network-activated.
Remediation
Immediate actions: (1) Update WP Email Debug plugin to version 1.1.1 or later (patch version must include capability checks in WPMDBUG_handle_settings() function); (2) For installations unable to patch immediately, disable or deactivate the WP Email Debug plugin via wp-admin dashboard or wp-cli (wp plugin deactivate wp-email-debug); (3) Review plugin settings to confirm no unauthorized email redirects or debugging configurations are in place; (4) Audit WordPress user accounts and administrator roles for unauthorized access created during the vulnerability window. Vendor advisory and patch should be obtained from wordpress.org plugin repository or the plugin's official GitHub/support channels. Implement Web Application Firewall (WAF) rules to block requests to WPMDBUG_handle_settings() from unauthenticated users as a temporary network-level mitigation. Long-term: consider plugin replacement with actively maintained debugging solutions that follow WordPress capability-checking best practices.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today