https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 23:21:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120040 <p>The Mail logging &amp; Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the &#39;message&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin&#39;s default_view_role setting to a capability held by low-privileged users such as &#39;read&#39;; on an untouched install the default of &#39;manage_options&#39; restricts log access to administrators only.</p> <p>The Mail logging &amp; Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the &#39;message&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin&#39;s default_view_role setting to a capability held by low-privileged users such as &#39;read&#39;; on an untouched install the default of &#39;manage_options&#39; restricts log access to administrators only.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120040 https://db.gcve.eu/vuln/ghsa-7xhr-q895-ggjm <p>The Mail logging &amp; Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the &#39;message&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin&#39;s default_view_role setting to a capability held by low-privileged users such as &#39;read&#39;; on an untouched install the default of &#39;manage_options&#39; restricts log access to administrators only.</p> <p>The Mail logging &amp; Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the &#39;message&#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin&#39;s default_view_role setting to a capability held by low-privileged users such as &#39;read&#39;; on an untouched install the default of &#39;manage_options&#39; restricts log access to administrators only.</p> https://db.gcve.eu/vuln/ghsa-7xhr-q895-ggjm