EUVD-2026-111719
GHSA-8xjg-cmc9-35px
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as delegated sub-admin role
-
DeliveryOpen activation-gated SMTP settings page
-
ExploitRepoint outbound mail to attacker server
-
ExecutionTrigger administrator password reset
-
PersistCapture reset email at attacker server
-
ImpactSeize administrator account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user whose delegated non-administrator role has been granted the plugin's activation capability; the GoSMTP SMTP configuration page enforces only that activation capability and omits a settings-management authorization check, letting such a user alter outbound mail delivery. Exploitation is limited by that prerequisite - the attacker must already possess a valid sub-administrator account with the activation capability, so this is not reachable by anonymous visitors - and is remediated by updating to GoSMTP 1.2.5. No user interaction by a victim is required (UI:N). |
| Impact | This is a genuine but conditional privilege-escalation/broken-access-control flaw (CWE-269) rather than a drive-by remote threat. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity attack that requires an authenticated account and yields full C/I/A impact via administrator takeover. The exploitation signals are modest: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit identified at time of analysis - only a WPScan advisory and the NVD entry. However, the vuln.today decision label is 'this_week' and a vendor patch is available, so this warrants prompt (within-the-week) remediation rather than emergency treatment. One signal to verify: the vendor assigned PR:H, yet the description says any 'delegated role below administrator' with the plugin's activation capability can exploit it, which points to a lower privilege bar (PR:L) and a higher real-world score than 7.2 - the authentication requirement is confirmed but its exact level should be verified against the WPScan advisory. |
| Exploit ScenarioDerived | An authenticated WordPress user holding a delegated non-administrator role (one granted the plugin's activation capability) opens the GoSMTP SMTP configuration page, which performs no proper settings-management authorization check. The user reconfigures outbound mail delivery to route WordPress mail (e.g., a triggered administrator password-reset email) through an attacker-controlled SMTP server, captures the reset link, and takes over the administrator account. No public exploit code is identified, but the attack is straightforward and requires no user interaction (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Authenticated WordPress users holding a delegated non-administrator role can rewrite the GoSMTP plugin's SMTP configuration in any version before 1.2.5, redirecting outbound mail and ultimately taking over an administrator account. The settings page is gated only on the plugin's activation capability and lacks a proper settings-management authorization check, so the flaw is a broken-access-control / improper-privilege-management issue rather than an anonymous remote attack - the attacker must already have a valid sub-administrator account with that capability. No public exploit code has been identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at roughly 0.15% (4th percentile), though the vendor has released a fix in 1.2.5 and the priority signal points to patching this week.
RemediationAI
Vendor-released patch: update the GoSMTP WordPress plugin to version 1.2.5, which adds the missing settings-management authorization check on the SMTP configuration page; the fix is documented at https://wpscan.com/vulnerability/8a20e9fd-9ed8-4984-b34a-2b29b4c8b133/. Where updating must be staged, the effective compensating control is to audit WordPress roles and remove the GoSMTP activation capability from every role below administrator so that only administrators can reach the SMTP configuration page - the trade-off is that delegated users lose all plugin management ability, including legitimate configuration work. As a detection and containment measure, review current SMTP host, port, credentials and encryption values for unauthorized changes and force a reset of administrator credentials and any accounts whose mail could have been intercepted, since redirection of outbound mail is the route to account takeover. Because the exploit requires an existing valid account with the activation capability, tightening role assignments and reviewing non-administrator users for unnecessary plugin capabilities reduces exposure until 1.2.5 is deployed on all sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is the GoSMTP WordPress plugin, a mail-delivery component that stores and applies SMTP host, port, credentials and encryption settings used for all outbound WordPress email. WordPress authorization is capability-based: pages and actions should verify both that a user holds the relevant capability and that the operation is appropriate for that capability. Here the SMTP configuration page checks only the plugin's activation capability (a capability that can be delegated to roles below administrator) and omits a settings-management check, which maps to CWE-269 Improper Privilege Management. Because control of the SMTP server means control of password-reset and notification mail, an attacker who can point delivery at their own mail server can capture administrator reset links and complete account takeover. The exact code path, hook and request parameters used to reach the configuration page are not described in the available sources; what is established is the missing authorization check and the capability-only gate. Affected code is identified by plugin version rather than CPE in the supplied data (EUVD lists GoSMTP 0 through <1.2.5).
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable settings page, low complexity, no victim interaction; PR:L because a low-privileged delegated (non-admin) role suffices, and full impact via administrator takeover gives C/I/A:H.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
Executive ViewAI
CVE-2026-111577 is a high-severity broken-access-control flaw in the GoSMTP WordPress plugin that permits authenticated users with delegated non-administrator roles to rewrite SMTP settings and redirect outbound email, ultimately enabling administrator account takeover. Although exploitation requires an existing low-privilege account and no public exploit code or active exploitation has been identified, the potential for email interception and full site compromise means security leadership should prioritize remediation for any WordPress deployment using GoSMTP versions before 1.2.5.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB