CVE-2024-0866

The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.

• CWE-94

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve

Published

Mar 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0859The Affiliates Manager plugin for WordPress is vulnerable to…4.3
• CVE-2024-0860 The affected product is vulnerable to a cleartext transmiss…7.5
• CVE-2024-0861An issue has been discovered in GitLab EE affecting all vers…4.3
• CVE-2024-0862The Proofpoint Encryption endpoint of Proofpoint Enterprise …5
• CVE-2024-0864Enabling Simple Ajax Uploader plugin included in Laragon ope…9.8
• CVE-2024-0865CWE-798: Use of hard-coded credentials vulnerability exists …7.8
• CVE-2024-0867The Email Log plugin for WordPress is vulnerable to Unauthen…8.1
• CVE-2024-0868The coreActivity: Activity Logging plugin for WordPress plug…5.3
• CVE-2024-0869The Instant Images – One Click Image Uploads from Unsplash, …6.5
• CVE-2024-0870The YITH WooCommerce Gift Cards plugin for WordPress is vuln…5.3
• CVE-2024-0871The Beaver Builder plugin for WordPress is vulnerable to Sto…5.4
• CVE-2024-0872The Watu Quiz plugin for WordPress is vulnerable to Sensitiv…4.3