A vulnerability in the Drupal Mailer Plus Log module allows attackers to cause the inclusion of sensitive information, such as user credentials, into log files. This leads to potential exposure of protected data and could result in credential theft if the logs are accessed by malicious actors. The weakness is identified as CWE-532, which concerns storing or transmitting sensitive data in a manner that is accessible or discoverable by unauthorized parties.

The affected product is the Mailer Plus Log module for Drupal. All versions from 0.0.0 up to and including 1.2.7 are vulnerable. No further vendor or product details are available in the source data.

The CVSS score for this vulnerability is 3.8, indicating a moderate severity impact. The EPSS score is listed as < 1%, suggesting a low likelihood of exploitation. The vulnerability is not cataloged in CISA KEV. Consequently, while the probability of exploitation remains low, the potential impact on confidentiality could be severe if logs are not adequately protected or access controls are weak, since the flaw enables remote services with stolen credentials to be written to a log file. The likely exploitation path is via remote service requests that include sensitive data, which the module then logs.