Bit Smtp CVE-2026-32519

Bit SMTP plugin versions <= 1.2.2 running on WordPress. Remote unauthenticated attacker can exploit via network. Requires high complexity attack vector; specific exploitation method not detailed in CVE description. No victim interaction needed.

The real-world risk of this vulnerability is significant despite the absence of a CVSS score and EPSS metric. The vulnerability is classified as a privilege escalation flaw affecting a widely-used WordPress plugin, which suggests high potential impact in WordPress environments. The fact that Patchstack has documented it and ENISA has assigned a formal EUVD identifier indicates credible security research and institutional recognition. Without published CVSS vector details, we cannot assess attack complexity or required privileges, but the nature of the flaw (privilege assignment errors) typically suggests low attack complexity and no special privileges required for exploitation. WordPress plugin vulnerabilities are frequently targeted by automated scanning tools, and privilege escalation flaws are prioritized by attackers. The absence of public POC or KEV status does not diminish the risk; rather, it suggests the vulnerability may not yet be widely exploited but remains a priority for patching before public disclosure amplifies threat activity.

An attacker with a low-privileged WordPress user account (such as a contributor or subscriber) could exploit the privilege assignment flaw in Bit SMTP to escalate their permissions to administrator level. By sending a crafted request to the plugin's SMTP configuration endpoints or email handling functions that fail to properly validate user capabilities, the attacker could modify email settings, access stored SMTP credentials, or execute administrative actions without proper authorization. This could lead to site compromise, credential theft, or use of the compromised site for further attacks.