WP Reroute Email
WP Reroute Email has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2023; all 3 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, SQL Injection.
Every one of the 3 issues recorded for WP Reroute Email has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, most of them (2) reported by Kévin Mosbahi (Mika). WP Reroute Email is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2023-3168WP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject
Read the full analysisVulnerability Records
WP Reroute Email
Author
Sajjad Hossain
This plugin intercepts all outgoing emails from a WordPress site, sent using the wp_mail() function, and reroutes them to a predefined configurable email address. This is useful in case where you do not want email sent from a WordPress site to reach the users. For an example, to resolve an issue you downloaded production database to your development site and you want no email is sent to production users when testing. You may enable this plugin in development server and reroute emails to your given email address. WP Reroute Email provides options for adding your own text or the recipients address at the bottom of the mail. You may also save a copy of the email to database and view them from the interface. Now, you will be able to disable rerouting based on the subject texts.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C