YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

2022-07-1100:00:00

Rafshanzani Suhada

165

yaysmtp plugin

subscriber+

smtp credentials

leak

http response

exploit

EPSS

0.001

Percentile

32.8%

JSON

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them

Install the plugin and configure any mailer other than Default.

Access the wp-admin area with a Subscriber+ user and monitor the traffic using your preferable tool.

Look for var yaySmtpWpData = in the HTTP Response and you'll find all the leaked credentials.

EPSS

0.001

Percentile

32.8%

JSON

Related for WPEX-ID:BEDDA2A9-6C52-478E-B17A-7A4488419334