Ultimate WP Mail <= 1.3.5 is vulnerable to Account Takeover via Email Log Leak Vulnerability

Subscriber

Published
2025-06-04

The Ultimate WP Mail plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVE

https://www.cve.org/CVERecord?id=CVE-2025-49288

CVSS

Score:8.8

Severity:High

Version: 1.3.5

There is a patch available in v1.3.6 and we strongly recommend you update to this version as soon as possible.