CVE-2023-5644

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

High · published December 26, 2023

CVSS v3.1
7.6
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.8th percentile
Published
2023-12-26T18:33Z
EPSS history
Timeline
  • 26 DEC 18:33Z
    WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints
    cvelistv5