CVE-2024-0867

The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.

• CWE-94

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027872%40email-log&new=3027872%40email-log&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/email-log/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3027872%40email-log&new=3027872%40email-log&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/email-log/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=cve

Published

May 24, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0860 The affected product is vulnerable to a cleartext transmiss…7.5
• CVE-2024-0861An issue has been discovered in GitLab EE affecting all vers…4.3
• CVE-2024-0862The Proofpoint Encryption endpoint of Proofpoint Enterprise …5
• CVE-2024-0864Enabling Simple Ajax Uploader plugin included in Laragon ope…9.8
• CVE-2024-0865CWE-798: Use of hard-coded credentials vulnerability exists …7.8
• CVE-2024-0866The Check & Log Email plugin for WordPress is vulnerable to …8.1
• CVE-2024-0868The coreActivity: Activity Logging plugin for WordPress plug…5.3
• CVE-2024-0869The Instant Images – One Click Image Uploads from Unsplash, …6.5
• CVE-2024-0870The YITH WooCommerce Gift Cards plugin for WordPress is vuln…5.3
• CVE-2024-0871The Beaver Builder plugin for WordPress is vulnerable to Sto…5.4
• CVE-2024-0872The Watu Quiz plugin for WordPress is vulnerable to Sensitiv…4.3
• CVE-2024-0873The Watu Quiz plugin for WordPress is vulnerable to Stored C…5.4