WP Mail Catcher EUVD-2026-114601

Exploitation requires two concrete preconditions. First, an administrator must have changed the plugin's 'default_view_role' setting to a capability held by low-privileged users (for example 'read'); on an untouched install the default of 'manage_options' restricts log access to administrators, blocking the attack entirely. Second, a valid administrator password-reset email containing a reset key must already have been captured in the plugin's stored email logs. The attacker must also hold at least a subscriber-level authenticated account (PR:L). These factors - non-default configuration and the presence of a logged reset email - are the main limiters on realistic exploitation despite the network attack vector.

This is a genuine privilege-escalation-to-administrator issue but with meaningful real-world limits, making it a priority below the 'drop everything' tier - consistent with the 'this_week' decision label. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 (High): network-reachable (AV:N), but requiring low-privilege authentication (PR:L, i.e. a subscriber account) and carrying AC:H. The AC:H and the full description together reflect a critical precondition: an administrator must have previously changed the plugin's default_view_role setting from the default 'manage_options' to a low-privilege capability such as 'read'. On a default install this attack is not possible, which materially lowers fleet-wide risk. There is no CISA KEV listing and no EPSS score supplied, so neither active exploitation nor a statistical exploitation-probability signal is available; no SSVC automatable/technical-impact triad was provided beyond the vendor priority label. No confirmed public exploit code is present in the inputs (only a Wordfence advisory and source links). Net: a legitimately high-impact flaw (full admin takeover of confidentiality, integrity and availability) gated behind a non-default misconfiguration plus a logged administrator password-reset email, so treat as a near-term patch priority rather than an emergency. The AC:H here denotes the configuration dependency, not a described race or timing condition.

On a site where an administrator has set the plugin's default_view_role to a low-privilege capability (e.g. 'read'), a logged-in subscriber opens the stored mail logs, locates a previously logged WordPress password-reset email for an administrator, and extracts the valid reset key from the 'message' parameter. The attacker then completes the standard WordPress password-reset flow with that key to set a new administrator password and take over the account. No public exploit code is identified in the provided inputs, though the trigger is straightforward log reading once the view-role precondition is met.