CVE-2023-5672 WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint

2023-12-2618:33:09

WPScan

www.cve.org

cve-2023-5672

wp mail log

lfi

wordpress plugin

file inclusion

security issue

EPSS

0.001

Percentile

18.3%

JSON

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Mail Log",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.1.3"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/7c1dff5b-bed3-49f8-96cc-1bc9abe78749

EPSS

0.001

Percentile

18.3%

JSON

Related for CVELIST:CVE-2023-5672