CVE-2026-120040 Details

A vulnerability allowing sensitive information exposure has been identified in the Mail Logging & Catcher plugin for WordPress, affecting all versions through 2.2.0. The issue arises via the 'message' parameter, enabling authenticated attackers with subscriber-level access or higher to retrieve valid password-reset keys for administrators from the plugin's email logs. This could be exploited to reset an administrator's password and gain elevated privileges. The vulnerability requires an administrator to have set the plugin's default_view_role to a capability accessible by lower-level users, such as 'read'.

Users are advised to update the Mail Logging & Catcher plugin to version 2.3.0 or later, where this vulnerability has been patched.