CVE-2026-2471

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2471", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T15:25:20.955Z", "datePublished": "2026-02-28T06:27:42.492Z", "dateUpdated": "2026-04-08T16:36:08.455Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:08.455Z"}, "affected": [{"vendor": "smub", "product": "WP Mail Logging", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.15.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `maybe_unserialize()` on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "title": "WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e4c52d-c82f-4393-9a56-5714b3a108d1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/lib/vendor/brandonwamboldt/wp-orm/src/BaseModel.php#L39"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/WPML_Plugin.php#L553"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/Renderer/WPML_MailRenderer_AJAX_Handler.php#L100"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464813%40wp-mail-logging&old=3358334%40wp-mail-logging&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "timeline": [{"time": "2026-02-13T15:40:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-27T17:58:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T19:40:13.816210Z", "id": "CVE-2026-2471", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:41:20.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2471", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T19:40:13.816210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:41:15.855Z"}}], "cna": {"title": "WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field", "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "smub", "product": "WP Mail Logging", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.15.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T15:40:49.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-27T17:58:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e4c52d-c82f-4393-9a56-5714b3a108d1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/lib/vendor/brandonwamboldt/wp-orm/src/BaseModel.php#L39"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/WPML_Plugin.php#L553"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/Renderer/WPML_MailRenderer_AJAX_Handler.php#L100"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464813%40wp-mail-logging&old=3358334%40wp-mail-logging&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `maybe_unserialize()` on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-28T06:27:42.492Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2471", "state": "PUBLISHED", "dateUpdated": "2026-03-02T19:41:20.206Z", "dateReserved": "2026-02-13T15:25:20.955Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-28T06:27:42.492Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Mail Logging", "vendor": "smub", "versions": [{"lessThanOrEqual": "1.15.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor calling `maybe_unserialize()` on all properties retrieved from the database without validation. This makes it possible for unauthenticated attackers to inject a PHP Object by submitting a double-serialized payload through any public-facing form that sends email (e.g., Contact Form 7). When the email is logged and subsequently viewed by an administrator, the malicious payload is deserialized into an arbitrary PHP object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}, {"lang": "es", "value": "El plugin WP Mail Logging para WordPress es vulnerable a la inyecci\u00f3n de objetos PHP en todas las versiones hasta la 1.15.0, inclusive, a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable desde el campo de mensaje del registro de correo electr\u00f3nico. Esto se debe a que el constructor de la clase 'BaseModel' llama a 'maybe_unserialize()' en todas las propiedades recuperadas de la base de datos sin validaci\u00f3n. Esto hace posible que atacantes no autenticados inyecten un objeto PHP al enviar una carga \u00fatil doblemente serializada a trav\u00e9s de cualquier formulario p\u00fablico que env\u00ede correo electr\u00f3nico (por ejemplo, Contact Form 7). Cuando el correo electr\u00f3nico es registrado y posteriormente visto por un administrador, la carga \u00fatil maliciosa es deserializada en un objeto PHP arbitrario. No hay una cadena POP conocida presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que otro plugin o tema que contenga una cadena POP est\u00e9 instalado en el sitio. Si una cadena POP est\u00e1 presente a trav\u00e9s de un plugin o tema adicional instalado en el sistema objetivo, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos sensibles o ejecutar c\u00f3digo, dependiendo de la cadena POP presente."}], "id": "CVE-2026-2471", "lastModified": "2026-06-17T10:31:07.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2471", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T19:40:13.816210Z", "version": "2.0.3"}}]}, "published": "2026-02-28T07:15:57.677", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/lib/vendor/brandonwamboldt/wp-orm/src/BaseModel.php#L39"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/Renderer/WPML_MailRenderer_AJAX_Handler.php#L100"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-mail-logging/tags/1.15.0/src/WPML_Plugin.php#L553"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464813%40wp-mail-logging&old=3358334%40wp-mail-logging&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e4c52d-c82f-4393-9a56-5714b3a108d1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.15.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Mail Logging", "source": "cna", "vendor": "smub"}, "product": "wp_mail_logging", "vendor": "smub"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:07:23.577697+00:00", "value": {"mitigation_remediation": ["Upgrade WP Mail Logging to the latest version that eliminates the deserialization flaw once it is released", "Disable or uninstall the plugin if email logging is not essential to site operation", "Configure the site so that only trusted administrators can view email logs, preventing accidental deserialization of malicious payloads"], "summary": {"action": "Assess Impact", "impact": "PHP Object Injection that could lead to Remote Code Execution if a POP chain is present"}, "threat_synthesis": {"affected_systems": "WordPress sites running WP Mail Logging version 1.15.0 or earlier developed by smub. The flaw targets the plugin\u2019s email logging functionality, which is triggered by any public\u2011facing form that sends e\u2011mail, such as Contact Form 7. The vulnerability is only exploitable if an administrator views the email logs and if a separate component supplies a POP chain.", "description_and_impact": "The WP Mail Logging plugin (smub) allows attackers to inject a PHP object through the email log message field. The vulnerability arises because the BaseModel constructor blindly unserializes all properties from the database without validation. An unauthenticated attacker can submit a double\u2011serialized payload via any public form that sends email, and when an administrator later views the logged email, the payload is deserialized into an arbitrary PHP object. No standalone execution path exists in the plugin itself; the impact becomes real only if another plugin or theme provides a POP chain such as __wakeup or __destruct hooks that can perform destructive actions, data exfiltration, or code execution.", "risk_and_exploitability": "The CVSS score is 7.5, indicating a high severity. The EPSS score is reported as less than 1%, reflecting the low likelihood that attackers will target this vulnerability at present. The flaw is not listed in the CISA KEV catalogue. Attackers can gain unauthenticated access by submitting malicious content via public forms. Exploitation requires the malicious payload to be deserialized when an admin inspects the email log, and a downstream POP chain is necessary for any consequential damage. Given the dependency on an additional component and the low EPSS, the practical risk is moderate, but the potential for RCE if a POP chain exists warrants timely mitigation."}}}}, "created": "2026-03-02T12:04:26.731104+00:00", "updated": "2026-04-15T20:15:13.713096+00:00", "vendors": ["smub", "smub$PRODUCT$wp_mail_logging", "wordpress", "wordpress$PRODUCT$wordpress"]}