Ultimate WP Mail 1.0.17 — 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Ultimate WP Mail.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 1.3.7, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Ultimate WP Mail to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to kr0d.

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the corresponding email log post content (including the password-reset link), relying only on the ‘edit_posts’ capability without restricting to administrators or validating ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to harvest an admin’s reset link and elevate their privileges to administrator.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 15, 2025

   CVE published

   Severity high, CVSS 7.5

2. Nov 13, 2026

   Record last updated