EUVD-2026-39662
GHSA-7h56-5554-rc7g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker requires no credentials (PR:N); victim's browser interaction is mandatory (UI:R); impact is limited to plugin configuration integrity (I:L), with no confidentiality or availability consequence.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.
AnalysisAI
Cross-Site Request Forgery in the Gmail SMTP WordPress plugin (versions up to and including 1.2.3.19) enables a remote unauthenticated attacker to trigger unauthorized state-changing actions on behalf of a logged-in WordPress administrator. The attacker does not need any credentials - only the administrator's authenticated browser session, obtained by luring them to a malicious page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a WordPress administrator with an active authenticated session visit an attacker-controlled page while logged into the WordPress backend; this is the UI:R condition confirmed by the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score of 4.3 (Medium) accurately reflects the constrained impact: integrity is only Low, with no confidentiality or availability consequence, and exploitation requires the victim's active browser interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a webpage containing a hidden HTML form that auto-submits a POST request to the target WordPress site's Gmail SMTP plugin settings endpoint. The attacker delivers a link to this page via phishing email or social engineering directed at a WordPress site administrator. … |
| Remediation | Update the Gmail SMTP WordPress plugin to the first version released after 1.2.3.19 that addresses this issue; the exact fixed version is not independently confirmed from the available data - consult the plugin's WordPress.org changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-19-cross-site-request-forgery-csrf-vulnerability for the confirmed patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today