PT-2025-29716 · WordPress · The Ultimate Wp Mail

Kenneth Dunn · Published 2025-07-16 · Updated 2025-08-02 · CVE-2025-6993

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Ultimate WP Mail versions 1.0.17 through 1.3.6

Description The plugin is susceptible to privilege escalation due to insufficient authorization within the get email log details() AJAX handler. The handler retrieves email log post content, including password-reset links, based on the post id supplied by the client. It relies solely on the ‘edit posts’ capability for access without validating ownership, allowing authenticated attackers with Contributor-level access or higher to obtain administrator reset links and elevate their privileges.

Recommendations The Ultimate WP Mail versions 1.0.17 through 1.3.6: Update to a version beyond 1.3.6.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-6993

Affected Products

The Ultimate Wp Mail

References · 11

• https://osv.dev/vulnerability/CVE-2025-6993 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3328277 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-6993 · Security Note
• https://t.me/cveNotify/130653 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ultimate-wp-mail/tags/1.3.6/includes/Ajax.class.php · Note
• https://twitter.com/cracbot/status/1947250253125796294 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b19794de-b623-4017-bd91-73986383c58b?source=cve · Note
• https://twitter.com/CVEnew/status/1945435480612589938 · Twitter Post
• https://wordpress.org/plugins/ultimate-wp-mail/#developers · Note
• https://twitter.com/VulmonFeeds/status/1945430611088273727 · Twitter Post
• https://t.me/cvenotify/129126 · Telegram Post