Easy WP SMTP before 1.4.4 writes its debug log, which records every outgoing email including password-reset links, to a predictably named text file inside the publicly accessible plugin directory. An unauthenticated attacker who can list or guess that file can request a password reset for an administrator and take over the account using the leaked link.
This vulnerability affects the following application versions:
- Easy WP SMTP 1.4.3