All versions of the WP Mail Logging plugin up to and including 1.17.0 allow an authenticated attacker who has administrator-level access to gain access to the contents of logged email messages that belong to other users. The vulnerability is caused by the use of the 'email_address' parameter in a SQL query that accepts a LIKE wildcard, thereby revealing recipients, subjects, bodies, and URLs from the mail log. The impact is a disclosure of personal and potentially sensitive information, but no code execution or system compromise is possible.

The vulnerability affects the WordPress plugin WP Mail Logging—any install that runs a version of the plugin that is 1.17.0 or older.

The CVSS score of 2.7 classifies the vulnerability as low severity. An attacker must first hold administrator credentials and then trigger a personal‑data export for an email address that contains a wildcard character (e.g., an underscore) that matches another user’s address in the mail log. Because the attack requires an authenticated user, no external attacker can exploit the flaw directly. The lack of an EPSS score and the fact that the vulnerability is not listed in KEV indicates that, while the flaw exists, it has not yet been widely exploited in the wild.