Mailer Plus Log
Monthly
The Drupal Mailer Plus Log contributed module writes sensitive information into its log files, exposing that data to anyone who can read the logs, up to and including version 1.2.7. Exploitation requires the module to be deployed on a Drupal site and an attacker who already holds high-privilege authenticated credentials able to reach the module's logging functionality, so this is a post-compromise information-disclosure issue rather than an anonymous-entry vector; the exact sensitive values logged and the operation that writes them are not described in the available sources. All signals converge on low real-world priority: EPSS is 0.15% (4th percentile), CISA SSVC records no known exploitation and no automatable path, no public exploit code is identified, and a vendor patch is available.
The Drupal Mailer Plus Log contributed module writes sensitive information into its log files, exposing that data to anyone who can read the logs, up to and including version 1.2.7. Exploitation requires the module to be deployed on a Drupal site and an attacker who already holds high-privilege authenticated credentials able to reach the module's logging functionality, so this is a post-compromise information-disclosure issue rather than an anonymous-entry vector; the exact sensitive values logged and the operation that writes them are not described in the available sources. All signals converge on low real-world priority: EPSS is 0.15% (4th percentile), CISA SSVC records no known exploitation and no automatable path, no public exploit code is identified, and a vendor patch is available.