CVE-2026-120040 The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-120040?
CVE-2026-120040 is a high-severity vulnerability in wardee Mail logging & Catcher, published on 31 Oct 2026.
Official description
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
Weakness: CWE-269
Which versions are affected by CVE-2026-120040?
How do I fix CVE-2026-120040?
No fix has been published for CVE-2026-120040 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-120040 being exploited?
There is no known exploitation of CVE-2026-120040 in the wild and no public exploit code.
Sources
Also known as GHSA-7xhr-q895-ggjm.