WP Mail Logging < 1.10.0 - Unauthenticated Arbitrary Settings Change
2021-11-29 00:00
Rotem ReissStrategic Overview
Vulnerability Overview
The WP Mail Logging plugin for WordPress is vulnerable to arbitrary settings change in versions before 1.10.0. This is due to the plugin using an outdated version of the Redux Framework. This makes it possible for unauthenticated attackers to arbitrarily change some plugin settings.
Technical Analysis
REMEDIATION: Update to version 1.10.0, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C