Skip to content
OpenAdvisories
High · 8.8 CVE-2025-60041 EUVD-2025-35427GHSA-pw9v-f8vg-xpg6

WordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerability

Published Oct 22, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.

Affected products

VendorProductAffectedFixed
Iulia Cazan Emails Catch All ≤ 3.5.3 —

References