Mail logging & Catcher: Sensitive Information Exposure (CVE-2026-120040)
The Mail logging & Catcher plugin for WordPress (<= 2.2.0) contains an information exposure vulnerability allowing authenticated users to extract password-reset keys and escalate privileges to administrator.
CVE search metadata
CVE search record: CVE-2026-120040. Severity: high. CVSS: 7.5. KEV: no. Product: Mail logging & Catcher (<= 2.2.0). Brief: Mail logging & Catcher: Sensitive Information Exposure (CVE-2026-120040). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mail-logging-catcher-vuln/
Triage facts
Revision 1- Applicability
- Mail logging & Catcher (<= 2.2.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 07:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-120040 affects the Mail logging & Catcher plugin for WordPress in all versions up to and including 2.2.0. The flaw resides in the 'message' parameter, which can leak sensitive data from stored email logs. Successful exploitation allows an authenticated user with at least subscriber-level access to access administrator password-reset keys, provided the 'default_view_role' setting has been configured to grant read access to low-privileged users. This can lead to unauthorized account takeover and privilege escalation to the administrator role.
Impact
The vulnerability allows authenticated, low-privileged users to intercept administrator password-reset tokens. By successfully hijacking the password-reset flow, an attacker can gain full administrative control over the affected WordPress installation.
Recommendation
- Update the Mail logging & Catcher plugin to the latest version once a patch is available.
- Audit the 'default_view_role' configuration within the plugin settings to ensure that access to email logs is restricted to the 'manage_options' capability or higher, preventing access by low-privileged user roles.
- Review WordPress audit logs for unusual password-reset activity initiated by non-administrative accounts.
Immediate actions
Review all WordPress installations for the presence of Mail logging & Catcher plugin and audit current 'default_view_role' configurations.
Threat Hunt
Search WordPress access logs for repeated requests to the Mail logging & Catcher plugin endpoints by non-administrative accounts, specifically targeting the 'message' parameter.
Data: Web server access logs (Apache/Nginx/IIS)
Mitigations
Change the 'default_view_role' to 'manage_options' or restrict plugin access via .htaccess/web server rules until a patch is applied.
CVE-2026-120040