CVE-2026-109401: WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'emailaddress' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with administrator-level access or higher can exploit it. The exposure is limited to mail-log entries for addresses matched by a wildcard in the attacker's email address.
What conditions are required for exploitation?
The attacker must have an email address containing a SQL LIKE wildcard character, such as an underscore, that matches another address present in the mail log. An administrator must also process a personal-data export request for that attacker through the standard WordPress privacy workflow.
What information could be exposed?
Matching complete logged-mail rows may be disclosed, including recipient addresses, message subjects, full message bodies, and URLs contained in those messages.
How can administrators assess whether they may have been affected?
Review personal-data export requests processed through the WordPress privacy workflow, especially requests for administrator accounts whose email addresses contain LIKE wildcard characters. Check whether WP Mail Logging contains mail-log entries for other addresses that could match those wildcard patterns.