Known vulnerabilities in Mail logging – WP Mail Catcher

Stop from ever losing your emails again! This fast, lightweight plugin (under 140kb in size!) is also useful for debugging or backing up your messages

7Reported vulnerabilities

7.5Highest CVSS score

2.1.12Latest version

20,000+Active installs

What to do now

Update Mail logging – WP Mail Catcher to 2.3.0 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 4, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-120040	High 7.5	0.3%	0 to 2.2.0 (inclusive)	`2.3.0`	October 31, 2026
CVE-2026-93889	High 7.2	0.2%	0 to 2.1.12 (inclusive)	`2.2.0`	October 3, 2026
WF-f3ebbf7f-61f2-403f-8131-8cedeb13c2d4	High 7.2	—	2.1.3 and earlier	`2.1.4`	October 29, 2023
CVE-2023-50844	Medium 6.6	0.5%	Before 2.1.4	`2.1.4`	December 21, 2023
CVE-2024-47339	Medium 6.1	0.3%	2.1.9 and earlier	`2.1.10`	September 27, 2024
CVE-2023-3080	Medium 6.1	0.5%	Before 2.1.3	`2.1.3`	July 12, 2023
CVE-2024-32099	Medium 4.3	0.2%	2.1.6 and earlier	`2.1.7`	April 11, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.