CVE-2023-5644

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

Affected

WP Mail Log

CVSS v3.1 NVD

7.6 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

0.50% chance of exploitation in the next 30 days, 41st percentile

Published

2023-12-26

Updated

2024-09-25

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e

References

• CVE Record
• NVD entry