CVE-2022-1412
📋 TL;DR
The Log WP_Mail WordPress plugin through version 0.1 saves sent emails in a publicly accessible directory with predictable filenames, allowing any unauthenticated visitor to access sensitive information like generated passwords. This affects all WordPress sites using vulnerable versions of the Log WP_Mail plugin.
💻 Affected Systems
- WordPress Log WP_Mail plugin
📦 What is this software?
Log Wp Mail by Premierethemes
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrative credentials, password reset tokens, or other sensitive data, leading to complete site compromise and data breaches.
Likely Case
Unauthenticated attackers access sensitive email content including passwords, user data, and internal communications.
If Mitigated
With proper access controls, only authorized users can access email logs, preventing information disclosure.
🎯 Exploit Status
Exploitation requires no authentication and uses predictable file paths. Public proof-of-concept scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.2 or later
Vendor Advisory: https://wpscan.com/vulnerability/ee10f21f-4476-4f3d-85ed-94d438c61ec2
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Log WP_Mail' plugin. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete plugin immediately.
🔧 Temporary Workarounds
Restrict directory access via .htaccess
linuxBlock public access to the wp-content/uploads/log-wp-mail directory
echo 'Deny from all' > /path/to/wp-content/uploads/log-wp-mail/.htaccess
Delete exposed log files
linuxRemove all existing log files from the vulnerable directory
rm -rf /path/to/wp-content/uploads/log-wp-mail/*
🧯 If You Can't Patch
- Immediately deactivate and remove the Log WP_Mail plugin from WordPress
- Implement web application firewall rules to block access to /wp-content/uploads/log-wp-mail/ paths
🔍 How to Verify
Check if Vulnerable:
Check if /wp-content/uploads/log-wp-mail/ directory exists and contains accessible .log files with predictable names (e.g., incrementing numbers)Check Version:
wp plugin list --name='Log WP_Mail' --field=versionVerify Fix Applied:
Verify plugin version is 0.2+ in WordPress admin, or test that /wp-content/uploads/log-wp-mail/ returns 403/404 error📡 Detection & Monitoring
Log Indicators:
- HTTP 200 requests to /wp-content/uploads/log-wp-mail/*.log from unauthenticated users
Network Indicators:
- Unusual traffic patterns to email log directories
SIEM Query:
source="web_access" AND uri_path="/wp-content/uploads/log-wp-mail/*" AND response_code=200