Ultimate WP Mail Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability has been identified in the Ultimate WP Mail plugin for WordPress, affecting versions 1.0.17 prior to 1.3.6. The vulnerability arises from improper authorization in the 'get_email_log_details()' AJAX handler, which allows authenticated users with Contributor-level access and above to access an admin's password reset link. The handler retrieves email log content based on a client-supplied post ID, relying solely on the 'edit_posts' capability without validating ownership or restricting access to administrators.

Impact

Exploitation of this vulnerability allows authenticated users with Contributor-level access and above to escalate their privileges to that of an administrator.

Remediation

Users can update to version 1.3.7 or a newer patched version to address this vulnerability.