CVE-2025-6993: Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content (including the password-reset link), relying only on the ‘editposts’ capability without restricting to administrators or validating ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to harvest an admin’s reset link and elevate their privileges to administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Ultimate WP Mail plugin so the get_email_log_details AJAX handler does not rely only on the 'edit_posts' capability; it must restrict access to administrators (or otherwise enforce the correct authorization model) and validate ownership/permissions for the client-supplied post_id before returning email log details.
WordPress (Ultimate WP Mail plugin) get_email_log_details AJAX handler authorization = Require administrator-only access and validate that the requesting user owns the targeted email log post before returning its content (including password-reset links) - Compensating control
Temporarily restrict access to the vulnerable plugin’s AJAX endpoint/route (e.g., via web server/WAF rules) so only trusted administrator sessions can invoke get_email_log_details, limiting contributor-level harvesting of admin password-reset links.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6993?
CVE-2025-6993 has a high severity level due to the potential for privilege escalation.
How do I fix CVE-2025-6993?
To fix CVE-2025-6993, update the Ultimate WP Mail plugin to a version beyond 1.3.6.
What versions are affected by CVE-2025-6993?
CVE-2025-6993 affects Ultimate WP Mail plugin versions 1.0.17 to 1.3.6.
What type of vulnerability is CVE-2025-6993?
CVE-2025-6993 is classified as a Privilege Escalation vulnerability.
Is CVE-2025-6993 targetting specific WordPress installations?
CVE-2025-6993 targets any WordPress installation using the affected versions of the Ultimate WP Mail plugin.