Executive brief
The Check & Log Email plugin for WordPress, which is used to monitor and record outgoing emails, contains a security flaw that allows administrators to perform unauthorized database queries. By exploiting this vulnerability, a user with administrative access could extract sensitive information from the website's database, such as password hashes of other users. This could lead to further account compromises or data theft if an administrative account is hijacked or misused.
Technical details
A SQL injection vulnerability exists in the Check & Log Email plugin for WordPress due to insufficient sanitization of the 'd' (date) and 's' (advanced search) parameters within the email log viewing functionality. An authenticated attacker with administrator privileges (specifically the 'manage_check_email' capability) can inject malicious SQL commands into these parameters. The vulnerability supports both time-based blind SQL injection and UNION-based extraction. Successful exploitation allows the attacker to read arbitrary data from the WordPress database, including user credentials from the wp_users table. The issue is resolved in version 2.0.15.
Affected products
- Unknown Check & Log Email < 2.0.15
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-13: patched: Fixed in version 2.0.15
- 2026-07-31: advisory: NVD published date