All vulnerabilities
CVE-2026-16648

Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

Drupal Mailer Plus LogApplications & CMS
Open in ThreatlineRecord JSON
CVSS
3.8Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.7Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

Text from CVE List

Affected versions 1

  • Mailer Plus Logaffected: 0.0.0 before 1.2.7CVE List

References 1