Ultimate WP Mail vulnerabilities

3 known vulnerabilities in Ultimate WP Mail from Rustaurius. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Ultimate WP Mail: Missing Authorization

  CVE-2025-6993Jul 16, 2025Rustaurius

  The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the correspon

• 8.8 High severity

  Ultimate WP Mail: Missing Authorization

  CVE-2025-49288Jun 6, 2025Rustaurius

  Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.

• 8.5 High severity

  Ultimate WP Mail: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-47490May 7, 2025Rustaurius

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.