CVE-2026-109401: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in smub WP Mail Logging

CVE-2026-109401 is a sensitive information exposure vulnerability (CWE-200) in the WP Mail Logging plugin for WordPress, affecting all versions up to and including 1.17.0. The flaw arises via the 'email_address' parameter in the personal-data export request workflow. An attacker with administrator privileges can craft an email address containing a SQL LIKE wildcard character (e.g., underscore) that matches other users' email addresses in the mail log. This allows extraction of complete logged mail entries for those users, including recipient addresses, message subjects, full message bodies, and URLs contained in the messages.

The vulnerability allows unauthorized disclosure of sensitive email log data to authenticated administrators who exploit the wildcard matching in the email address parameter. The exposed data includes potentially sensitive personal information contained in email logs. However, exploitation requires administrator-level privileges and the use of the WordPress privacy export workflow. The CVSS score is low (2.7), reflecting limited impact and high privileges required.

No official patch or fix is currently documented for this vulnerability. Administrators should be cautious when processing personal-data export requests involving email addresses with wildcard characters. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to obtain any forthcoming fixes. Until a patch is available, restrict administrator access to trusted personnel and avoid processing export requests with crafted wildcard email addresses.