CVE-2026-93889: Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wpmailfailed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites running Mail logging – WP Mail Catcher version 2.1.12 or earlier are exposed when they also have a plugin, such as Contact Form 7, that lets unauthenticated users supply input to mail fields included by PHPMailer in a mail-send failure message.
What must an attacker do to trigger the stored script injection?
The attacker must submit crafted unauthenticated input through a compatible mail-producing plugin and cause PHPMailer to include that input in a wp_mail_failed error message. The payload is stored and executes when a user accesses the injected page.
Is the default plugin installation alone sufficient for exploitation?
No. Successful exploitation requires a separately installed plugin that passes unauthenticated, attacker-controlled input into relevant mail fields and a PHPMailer mail failure that records the resulting error message.