Emails Catch <= 3.5.3 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation

The Emails Catch All plugin for WordPress is vulnerable to privilege escalation via email log exposure in all versions up to, and including, 3.5.3. This is due to the plugin not properly restricting access to email logs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a password reset email that gets logged for all users, including administrators, and leverage that to reset the user's password and gain access to their account.