Easy WP SMTP

Easy WP SMTP before 1.4.4 writes its debug log, which records every outgoing email including password-reset links, to a predictably named text file inside the publicly accessible plugin directory. An unauthenticated attacker who can list or guess that file can request a password reset for an administrator and take over the account using the leaked link.

This vulnerability affects the following application versions:

• Easy WP SMTP 1.4.3

Unauthenticated user was able to exploit the admin page because it was possible to view/delete the log, import/export the configuration of the plugin and update WordPress options in the database.

This vulnerability affects the following application versions:

• Easy WP SMTP 1.2.8
• Easy WP SMTP 1.2.9
• Easy WP SMTP 1.3.0
• Easy WP SMTP 1.3.1
• Easy WP SMTP 1.3.2
• Easy WP SMTP 1.3.3
• Easy WP SMTP 1.3.4
• Easy WP SMTP 1.3.5
• Easy WP SMTP 1.3.6
• Easy WP SMTP 1.3.7
• Easy WP SMTP 1.3.8
• Easy WP SMTP 1.3.8.1
• Easy WP SMTP 1.3.9