Mail logging & Catcher
Mail logging & Catcher has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 3 high. 2023 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).
Every one of the 6 issues recorded for Mail logging & Catcher has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, most of them (2) reported by Muhammad Daffa. Mail logging & Catcher is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-93889Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
Read the full analysisVulnerability Records

Mail logging & Catcher
Author
JWardee
Logging your mail will stop you from ever losing your emails again! This fast, lightweight plugin (under 140kb in size!) is also useful for debugging or backing up your messages. Just install and activate then all of your contact form emails will be logged and saved to your DB with no additional configuration required. View and manage all your form submissions through the default WordPress interface. An email failed to send? With a single click you can resend the backed up email. Send emails out directly from the WordPress interface. Also includes support for attachments. Immediately find out if your contact form submission was successfully sent. Features Zero setup required – just install and away you go Minimalistic – no overbloated features you never use weighing your site down – under 140kb in size! Bulk export emails to CSV for easy inclusion into Excel or any other program Compose new emails with the WordPress controls you’re already familiar with Resend your emails in bulk Debugging – see exactly which file and code line was responsible for sending the email, along with any errors encountered Manage what user permissions can see the logs Routinely have your logs cleared out at a specified time – or keep them forever Need to be notified when there’s a problem sending your mail? We’ve got hooks that allow you to do just that Completely free Hooks and actions wp_mail_catcher_mail_success is triggered when a message is sent and logged successfully. It has a single argument that is an array containing the log id related to the id in the mail_catcher_logs MySQL table time relative, readable time to when the log was saved email_to the email address(es) that the message was sent to subject the subject line of the message message the contents of the message status an integer depicting if the message was sent successfully or not (1 = sent successfully. 0 = sending failed) error the error that occurred – if any backtrace_segment a json_encoded object that shows which file and line the mail was initially triggered from attachments a list of any attachments that were sent along with the email additional_headers a list of any headers that were sent attachment_file_paths a list of the location of any attachments that were sent timestamp a unix timestamp of when the email was sent is_html a boolean, that will be true if the message is a html email and false if not email_from the from value of the email wp_mail_catcher_mail_failed is triggered when a message failed to send and logged successfully. It has a single argument that is an array containing the log (same as the arguments for wp_mail_catcher_mail_success) wp_mail_catcher_deletion_intervals is a filter that should return an array where each key is an amount of time in seconds, and the value is the label. Used to determine when a message has expired and should be deleted wp_mail_catcher_before_success_log_save is a filter that is called just before a successful log is saved. It has a single argument that is the transformed log that will be saved – use this to alter the log before it’s saved. Returning false will stop the log from being saved. Also note that this is fired even when an email has errored, because all logs are initially saved as “successful” before being possibly updated with an error (if applicable). This is because of the way the wp_mail and wp_mail_failed are implemented in WordPress. time a unix timestamp of when the email was sent email_to the email address(es) that the message was sent to subject the subject line of the message message the contents of the message backtrace_segment an array that shows which file and line the mail was initially triggered from wp_mail_catcher_before_error_log_save time a unix timestamp of when the email was sent email_to the email address(es) that the message was sent to subject the subject line of the message message the contents of the message backtrace_segment an array that shows which file and line the mail was initially triggered from error the error that occurred wp_mail_catcher_redact is a filter that is called on the subject and message of a log, both before it’s saved and before it’s displayed – use this to remove sensitive content (e.g. tokens or links) from the logs. It has two arguments, the content being redacted and the name of the field (subject or message), and should return the redacted content. By default URLs containing action=rp or key= (such as password reset links) are replaced with [redacted], this can be turned off in the settings screen. Note that resending a log sends the redacted content
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C