Vulnerability · Published Dec 26, 2023 · Assigned by WPScan

CVE-2023-5672WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint

Medium 6.5

In plain English

A medium-severity security flaw in WP Mail Log from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)0.7%top 46.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Mail Log	0 – before 1.1.3

References

https://wpscan.com/vulnerability/7c1dff5b-bed3-49f8-96cc-1bc9abe78749 exploit, vdb-entry, technical-description