WP Mail Log [wp-mail-log] < 1.1.3
unknown[en] Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.
- Affected:
- up to 1.1.3
- Fixed in:
- 1.1.3
- Disclosed:
- Dec 29, 2023
plugin
20 known security issues reported for the Wp Mail Log WordPress plugin. Most recent disclosed Dec 29, 2023.
Running Wp Mail Log on your site? Check whether your installed version is affected.
Scan your site free[en] Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.
The WP Mail Log plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'send_email' function in all versions up to and including 1.1.2. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's...
[en] The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
[en] The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
[en] The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
[en] The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
[en] The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
The WP Mail Log plugin for WordPress is vulnerable to SQL Injection via the 'key'’ parameter in all versions up to, and including, 1.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with con...
The WP Mail Log plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.1.2 via the includeAttachment parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and read arbitrary files on the server.
The WP Mail Log plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the check_permission() function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with contributor-level access and above, to access REST rout...
The WP Mail Log plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor and higher users to appe...
The WP Mail Log plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for contributor and higher users to appe...
Update the WordPress WP Mail Log plugin to the latest available version (at least 1.1.3). WordFence discovered and reported this SQL Injection vulnerability in WordPress WP Mail Log Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. Thi...
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...
[en] The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wh...
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wheneve...
[en] Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.
The WP Mail Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the wpv_mail_review function. This makes it possible for unauthenticated attackers to review the plugin, via forged request granted they can t...
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Update the WordPress WP Mail Log plugin to the latest available version (at least 1.0.2). Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP Mail Log Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their c...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free