PT-2022-13868 · WordPress · Wp Mail Log

Daniel Ruf · CVE-2022-1412 · Published 2022-06-13 · Updated 2023-08-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Log WP Mail WordPress plugin versions 0.1 and earlier

Description The issue allows any unauthenticated visitor to obtain potentially sensitive information, such as generated passwords, due to sent emails being saved in a publicly accessible directory using predictable filenames.

Recommendations For Log WP Mail WordPress plugin version 0.1 and earlier, consider updating to a version where this issue is resolved, or as a temporary workaround, restrict access to the publicly accessible directory where sent emails are stored.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-1412

Affected Products

Wp Mail Log

References · 4

• 🔥 https://wpscan.com/vulnerability/ee10f21f-4476-4f3d-85ed-94d438c61ec2 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1412 · Security Note
• https://t.me/cvenotify/55056 · Telegram Post