Emails Catch All
Emails Catch All has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for Emails Catch All has a vendor fix available, so running the current release closes it.
All of these findings were reported by Denver Jackson. Emails Catch All is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-60041Emails Catch <= 3.5.3 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation
Read the full analysisVulnerability Records
Emails Catch All
Author
Iulia Cazan
This is a plugin that allows you to set a catch all emails address that will receive a copy of all the emails sent from the application or that will replace the recipients for all the emails sent. Also, the plugin allows to set the content type of the emails and to record the history of the outgoing messages, and provides the interface for configuring SMTP options and emails error display. Hooks secas_cleanup_hook License This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C