What is the CVSS score of CVE-2025-62123?

CVE-2025-62123 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62123

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP plugin through version 1.0.7 allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects the WordPress plugin across all versions up to and including 1.0.7, enabling attackers to potentially modify email configuration settings or other administrative functions via crafted web requests. No public exploit code has been identified at the time of analysis, and the EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite the theoretical attack surface.

Technical ContextAI

This vulnerability stems from inadequate CSRF token validation in the WP Gmail SMTP plugin, a WordPress extension designed to handle SMTP email configuration. The root cause is classified under CWE-352 (Cross-Site Request Forgery), which occurs when the plugin fails to implement or properly validate security tokens (nonces) that protect state-changing operations. WordPress applications process requests based on authenticated sessions, and without proper CSRF protections, an attacker can craft malicious HTML or JavaScript that, when visited by an authenticated admin, triggers unwanted actions such as modifying SMTP credentials, changing email settings, or potentially escalating privileges. The CPE context indicates this is a WordPress plugin vulnerability affecting the wp-gmail-smtp component distributed through the WordPress plugin ecosystem.

Affected ProductsAI

inkthemes WP Gmail SMTP plugin for WordPress is affected in all versions from the earliest release through version 1.0.7 inclusive. The vulnerability impacts any WordPress installation with this plugin installed and activated, regardless of WordPress version. Users can identify their installation version through the WordPress plugin management interface, and the vulnerability applies to any configuration using the affected plugin.

RemediationAI

Update the WP Gmail SMTP plugin to a version newer than 1.0.7 once the vendor releases a patched version. Check the plugin's WordPress repository page or the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/wp-gmail-smtp/vulnerability/wordpress-wp-gmail-smtp-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability for the latest available version and upgrade instructions. As an interim measure, restrict administrative access to trusted users only and monitor for unauthorized changes to SMTP settings through WordPress audit logs. If the plugin is not actively required for email functionality, consider temporarily disabling it until a patch is confirmed available.