WordPress Easy WP SMTP Password Reset

Wordpress plugin Easy WP SMTP versions less than or equal to 1.4.2 was found to not include index.html within its plugin folder. This potentially allows for directory listings. If debug mode is also enabled for the plugin, all SMTP commands are stored in a debug file. An email must have been sent from the system as well to create the debug file. If an email hasnt been sent (Test Email function not included), Aggressive can bypass the last check. Combining these items, its possible to request a password reset for an account, then view the debug file to determine the link that was emailed out, and reset the users password.