WP Mail Logging EUVD-2026-102800

Exploitation requires administrator-level (or higher) authentication on the target WordPress site - confirmed by CVSS PR:H. Two concrete additional preconditions limit realistic exploitation: (1) the WordPress personal-data export (privacy) workflow must be invoked for the attacker's email address, and (2) the attacker's email address must contain a SQL LIKE wildcard character (such as an underscore '_') that happens to match at least one other user's address stored in the mail log. The flaw is in WPML_PrivacyController.php passing an unescaped value into the plugin's wp-orm LIKE query (Query.php L399). Limiting factors: the high admin privilege requirement, the dependency on the specific privacy-export action, the need for a wildcard-bearing address, and the requirement that other matching addresses exist in the log - making this most impactful only on multi-admin/multisite installations. Affected product: WP Mail Logging (cpe smub:wp_mail_logging) versions up to and including 1.17.0; fixed in 1.17.1.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-assigned CVSS 3.1 score is 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring high privileges (administrator-level), with only limited confidentiality impact and no integrity or availability impact. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is not listed in CISA KEV and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Critically, the attacker must already hold administrator-level access (PR:H) on the WordPress site, which severely limits practical value: an administrator already has broad access to the mail log, so the incremental disclosure is marginal. The one nuance is that it lets one admin-level user read mail rows belonging to OTHER users whose addresses match a SQL LIKE wildcard, which is a real but narrow data-segregation/privacy boundary violation (relevant mainly in multi-admin or multisite contexts). Bottom line: high-CVSS this is not, and even the Low rating overstates urgency given the admin prerequisite and the convoluted precondition (an admin must process a personal-data export for a wildcard-bearing address).

On a multi-admin or multisite WordPress install running WP Mail Logging ≤1.17.0, an administrator-level user registers or uses an email address containing a SQL LIKE wildcard (e.g. an underscore) and triggers the standard WordPress personal-data export workflow for that address. The unescaped wildcard causes the plugin's ORM query to match other users' logged mail rows, returning their recipient addresses, subjects, full bodies, and embedded URLs in the export. No public exploit code is referenced; exploitation requires existing admin privileges and the user-data export action.