Lucene search
Daniel RufWPVDB-ID:EE10F21F-4476-4F3D-85ED-94D438C61EC2HistoryMay 18, 2022 - 12:00 a.m.
Log WP_Mail <= 0.1 - Email Logs Publicly Accessible
2022-05-1800:00:00
Daniel Ruf
wpscan.com
7
wordpress
email
security
EPSS
0.002
Percentile
58.9%
The plugin saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
PoC
curl https://example.com/wp-content/plugins/logwpmail/log/LWPMAIL-20220330-success.log
Related
cve
cve
CVE-2022-1412
2022-06-13 13:15:10
patchstack
patchstack
WordPress Log WP_Mail plugin <= 0.1 - Sensitive Data Exposure vulnerability
2022-05-18 00:00:00
prion
prion
Information disclosure
2022-06-13 13:15:00
wpexploit
wpexploit
Log WP_Mail <= 0.1 - Email Logs Publicly Accessible
2022-05-18 00:00:00
cvelist
cvelist
CVE-2022-1412 Log WP_Mail <= 0.1 - Email Logs Publicly Accessible
2022-06-13 12:41:48
cnvd
cnvd
WordPress Log WP_Mail plugin information leakage vulnerability
2022-06-15 00:00:00
nvd
nvd
CVE-2022-1412
2022-06-13 13:15:10