CVE-2026-32538 HIGH

CVE-2026-32538: WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability

Vendor Noor Alam

Product SMTP Mailer

Weakness CWE-201

Published March 25, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through <= 1.1.24.

Explanation of Vulnerability in Simple Terms

02Summary

SMTP Mailer versions up to 1.1.24 expose sensitive information to unauthenticated attackers over the network. An attacker can read confidential data without needing credentials or user interaction. The vulnerability stems from insufficient access controls on information disclosure. Update to a version newer than 1.1.24 to remediate.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the SMTP Mailer without authentication.

Potential impact on your site

04Site Impact

Confidential data may be exposed to anyone on the network without requiring a password or login.

Conditions required to exploit

05Prerequisites

Network access to the affected SMTP Mailer instance; no authentication required.

Key dates

06Disclosure timeline

March 25, 2026 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32538 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities