What is the CVSS score of CVE-2026-4162?

CVE-2026-4162 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4162?

Gravity SMTP plugin for WordPress versions 2.1.4 and below contains a missing authorization vulnerability that allows any subscriber-level user to disable email functionality and remove plugin…

How to fix or mitigate CVE-2026-4162?

Within 24 hours: Audit all WordPress user accounts and document subscriber-level user assignments; identify if Gravity SMTP plugin is active and determine version via WordPress admin dashboard. Within 7 days: Restrict subscriber-level role permissions in WordPress to eliminate access to plugin settings; alternatively, temporarily restrict subscriber access until vendor patch available. Within 30 days: Contact Rocketgenius for patched version availability and plan upgrade to version >2.1.4 once released; document timeline with vendor.

WordPress CVE-2026-4162

EUVD-2026-21356 HIGH

Missing Authorization (CWE-862)

2026-04-10 Wordfence

GHSA-66q3-hgw9-jr5j

WordPress CSRF Authentication Bypass

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 10, 2026 - 09:45 euvd

EUVD-2026-21356

Analysis Generated

Apr 10, 2026 - 09:45 vuln.today

CVE Published

Apr 10, 2026 - 09:25 nvd

HIGH 7.1

DescriptionCVE.org

The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to uninstall and deactivate the plugin and delete plugin options. NOTE: This vulnerability is also exploitable via a Cross-Site Request Forgery vector.

AnalysisAI

Missing authorization in Gravity SMTP plugin for WordPress (versions ≤2.1.4) allows authenticated attackers with subscriber-level privileges to uninstall the plugin, deactivate functionality, and delete configuration options. Exploitable via direct API calls or CSRF attack vectors. Affects Gravity SMTP by Rocketgenius. Successful exploitation enables low-privileged users to disable critical SMTP mail delivery functionality and remove plugin settings without proper permission checks. No public exploit identified at time of analysis.

Technical ContextAI

Root cause: missing capability checks on administrative endpoints (CWE-862). CVSS vector PR:L confirms authenticated access required. CSRF vector (UI:N indicates no user interaction for direct exploitation) enables social engineering attack chains. Affects cpe:2.3:a:rocketgenius:gravity_smtp through version 2.1.4. Authorization bypass permits subscriber role to invoke privileged uninstall/deactivate operations.

RemediationAI

Vendor-released patch: upgrade to Gravity SMTP version 2.1.5 or later, which implements proper authorization controls for administrative actions. Gravity Forms release announcement confirms fix availability at https://www.gravityforms.com/brand-new-release-gravity-smtp-2-1-5/. Immediate mitigation: restrict WordPress subscriber role permissions via role manager plugins, implement Web Application Firewall rules blocking unauthorized admin-ajax.php requests from low-privilege users, audit user role assignments to minimize subscriber-level accounts. Post-upgrade verification: test that subscriber accounts cannot access plugin deactivation or settings deletion endpoints. Monitor access logs for suspicious administrative API calls from non-administrator sessions.