The WP Mail Logging plugin (smub) allows attackers to inject a PHP object through the email log message field. The vulnerability arises because the BaseModel constructor blindly unserializes all properties from the database without validation. An unauthenticated attacker can submit a double‑serialized payload via any public form that sends email, and when an administrator later views the logged email, the payload is deserialized into an arbitrary PHP object. No standalone execution path exists in the plugin itself; the impact becomes real only if another plugin or theme provides a POP chain such as __wakeup or __destruct hooks that can perform destructive actions, data exfiltration, or code execution.

WordPress sites running WP Mail Logging version 1.15.0 or earlier developed by smub. The flaw targets the plugin’s email logging functionality, which is triggered by any public‑facing form that sends e‑mail, such as Contact Form 7. The vulnerability is only exploitable if an administrator views the email logs and if a separate component supplies a POP chain.

The CVSS score is 7.5, indicating a high severity. The EPSS score is reported as less than 1%, reflecting the low likelihood that attackers will target this vulnerability at present. The flaw is not listed in the CISA KEV catalogue. Attackers can gain unauthenticated access by submitting malicious content via public forms. Exploitation requires the malicious payload to be deserialized when an admin inspects the email log, and a downstream POP chain is necessary for any consequential damage. Given the dependency on an additional component and the low EPSS, the practical risk is moderate, but the potential for RCE if a POP chain exists warrants timely mitigation.