Critical · published June 6, 2025
🚨 A missing capability check in the WP Email Debug plugin turns innocent settings into a hacker's playground! 🔥 Think of it like a hotel front desk that hands out master keys without checking ID – anyone could waltz into any room, and chaos could ensue! An unauthenticated attacker could enable debugging, reroute all emails to their own address, and then trigger a password reset for an administrator account. This means they could effectively take over the entire site, accessing sensitive data and causing absolute havoc!
Think of it like a hotel front desk that hands out master keys without checking ID – anyone could waltz into any room, and chaos could ensue! This vulnerability arises from a lack of proper capability checks in the WPMDBUG_handle_settings() function, allowing attackers to manipulate email settings without authentication.
An unauthenticated attacker could enable debugging, reroute all emails to their own address, and then trigger a password reset for an administrator account. This means they could effectively take over the entire site, accessing sensitive data and causing absolute havoc! Update the WP Email Debug plugin to version 1.1.1 or later immediately to close this gap. Additionally, review user permissions to ensure only authorized individuals can make sensitive changes. Don't leave your site exposed! You've got this! Take action now and secure your WordPress site like a pro! 🛡️