CVE-2025-5486: Dr Scythe Wp Email Debug

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUG_handle_settings() function in versions 1.0 to 1.1.0. This makes it possible for unauthenticated attackers to enable debugging and send all emails to an attacker controlled address and then trigger a password reset for an administrator to gain access to an administrator account.

Affected products

• Dr Scythe Wp Email Debug: from 1.0, up to and including 1.1.0

Published 2025-06-06. Last modified 2026-06-17.