CVE-2023-5644: WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-26 · updated 2026-06-17
Weakness: CWE-863

Description

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

Affected products

WP Mail Log: before 1.1.3 — fixed in 1.1.3

How to fix

Upgrade to a fixed version: WP Mail Log 1.1.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e

Get alerted when CVE-2023-5644 or the next vulnerability affects your stack