Answer in brief
CVE-2026-120040 records a High severity (CVSS 7.5) vulnerability in Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure. The current sources do not mark it as known exploited. The current feed maps wardee/Mail logging & Catcher (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps wardee/Mail logging & Catcher (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| wardee/Mail logging & Catchergeneric | >=0 <=2.2.0 | Not reported |
Published upstream
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 31, 2026
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
Quoted source text, attributed separately from HOL analysis.