CVE-2024-0866
Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
| CWE | CWE-94 |
| Vendor | checkemail |
| Product | check & log email – easy email testing & mail logging |
| Published | Mar 26, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for checkemail check & log email – easy email testing & mail logging
Be the first to know when new high vulnerabilities affecting checkemail check & log email – easy email testing & mail logging are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
checkemail / Check & Log Email – Easy Email Testing & Mail logging
0 ≤ 1.0.9
References
Credits
Sean Murphy