CVE-2025-24567: WP Mailster Information Disclosure Flaw

CVE-2025-24567 Overview

CVE-2025-24567 is a sensitive information disclosure vulnerability in the WP Mailster plugin for WordPress, developed by brandtoss. The flaw affects all versions up to and including 1.8.16.0 and is categorized under [CWE-201]: Insertion of Sensitive Information Into Sent Data. Authenticated users with low privileges can retrieve embedded sensitive data through the plugin's normal data transmission paths. The vulnerability requires network access but no user interaction and does not impact integrity or availability.

Critical Impact
Authenticated low-privileged users can retrieve embedded sensitive data from WP Mailster, exposing confidential information contained in plugin-generated communications.

Affected Products

brandtoss WP Mailster plugin for WordPress
All versions from n/a through <= 1.8.16.0
WordPress installations with the affected plugin enabled

Discovery Timeline

2025-02-14 - CVE-2025-24567 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24567

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive data during transmission. WP Mailster embeds sensitive information into responses or outbound data accessible to authenticated users who should not have visibility into that data. The classification under [CWE-201] indicates the plugin inserts confidential content into messages or responses reachable across a trust boundary. Exploitation does not require elevated privileges or user interaction. See the Patchstack WP Mailster Vulnerability advisory for additional technical context.

Root Cause

The underlying cause is missing or insufficient filtering of sensitive fields before data is emitted by the plugin. WP Mailster fails to strip or redact confidential information when constructing outbound payloads. Any authenticated actor with at least subscriber-level access can trigger the affected code path and observe the disclosed data.

Attack Vector

An attacker authenticates to the WordPress site using any valid low-privilege account. The attacker then interacts with WP Mailster functionality that returns data containing embedded sensitive fields. No specialized tooling or complex payload crafting is required. The impact is limited to confidentiality; integrity and availability of the affected instance are not directly affected.

No public proof-of-concept code is available for this vulnerability. Refer to the vendor advisory linked in the references for authoritative technical details.

Detection Methods for CVE-2025-24567

Indicators of Compromise

Unexpected access patterns from low-privileged accounts to WP Mailster endpoints or admin-ajax handlers
WordPress access logs showing repeated requests to WP Mailster-related URIs by non-administrative users
Outbound emails or plugin responses containing internal configuration or user data beyond expected scope

Detection Strategies

Inventory WordPress deployments and identify sites running WP Mailster at version 1.8.16.0 or earlier
Review web server logs for authenticated requests targeting WP Mailster plugin endpoints from unusual user accounts
Correlate authentication events with plugin data-retrieval actions to identify anomalous access

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward logs to a centralized SIEM for correlation
Alert on newly created low-privilege accounts followed by access to plugin admin endpoints
Monitor plugin update status across all managed WordPress sites to identify unpatched instances

How to Mitigate CVE-2025-24567

Immediate Actions Required

Update WP Mailster to a version newer than 1.8.16.0 as soon as the vendor publishes a fixed release
Audit all WordPress user accounts and remove unused or dormant low-privileged accounts
Review recent WP Mailster activity for signs of sensitive data retrieval by unauthorized users

Patch Information

WP Mailster versions through 1.8.16.0 are affected. Consult the Patchstack advisory for the current patched version and vendor guidance. Apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Disable the WP Mailster plugin until a patched version is installed if the plugin is not business-critical
Restrict access to the WordPress admin area using IP allowlisting at the web server or WAF layer
Enforce strong registration controls and disable open user registration where feasible

bash

# Update WP Mailster using WP-CLI once a patched version is available
wp plugin update wp-mailster --path=/var/www/html

# Alternatively, deactivate the plugin as a temporary workaround
wp plugin deactivate wp-mailster --path=/var/www/html