What is the CVSS score of CVE-2026-6963?

CVE-2026-6963 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WP Mail Gateway are affected by CVE-2026-6963?

WP Mail Gateway plugin (versions 1.8 and earlier) contains a privilege escalation vulnerability allowing low-level WordPress users to redirect site emails and intercept password reset tokens,…

How to fix or mitigate CVE-2026-6963?

Within 24 hours: Identify all WordPress installations using WP Mail Gateway ≤1.8 via plugin inventory and disable the plugin immediately as interim protection. Within 7 days: Update to WP Mail Gateway version 1.9 or later (when released by vendor), or remove the plugin entirely if no patched version is available; review SMTP configuration and password reset email logs for unauthorized changes. Within 30 days: Conduct security audit of all WordPress user accounts for unauthorized privilege escalations; implement role-based access controls restricting SMTP configuration access to Administrator accounts only; deploy Web Application Firewall rules blocking wmg_save_provider_config AJAX requests from non-administrator users.

WP Mail Gateway CVE-2026-6963

EUVD-2026-26736 HIGH

Missing Authorization (CWE-862)

2026-05-02 security@wordfence.com

Authentication Bypass WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26736

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

HIGH 8.8

DescriptionCVE.org

The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update SMTP settings and redirect mail which can be used for privilege escalation by triggering a password reset email and using that to access and administrator's account.

AnalysisAI

Missing capability check in WP Mail Gateway plugin for WordPress (versions ≤1.8) allows authenticated attackers with Subscriber-level privileges to modify SMTP settings via the wmg_save_provider_config AJAX action, enabling mail redirection. Attackers exploit this by redirecting password reset emails to attacker-controlled servers, then using intercepted credentials to escalate privileges to Administrator. CVSS 8.8 (High) reflects the severe impact despite requiring initial low-level authentication. No active exploitation confirmed via CISA KEV, but Wordfence reporting indicates discovery by security researchers and likely inclusion in their threat intelligence feeds.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), where the WP Mail Gateway plugin fails to validate user capabilities before processing AJAX requests to wmg_save_provider_config. WordPress AJAX handlers should implement capability checks using WordPress core functions like current_user_can() to ensure only privileged users (e.g., manage_options capability for administrators) can modify sensitive settings. The vulnerable code in Bootstrap.php (line 47) and Functions.php (line 111) exposes SMTP configuration parameters-including server address, port, authentication credentials-to any authenticated user. By manipulating these settings, attackers redirect WordPress outbound mail (password resets, admin notifications) to attacker-controlled SMTP servers, intercepting sensitive authentication tokens. This is a classic capability bypass in WordPress plugin architecture, where developers incorrectly assume AJAX nonces alone provide sufficient security without role-based access control.

RemediationAI

Upgrade WP Mail Gateway plugin to the patched version released after changeset 3515205 (exact version number requires verification from WordPress.org plugin repository-likely 1.9 or later based on typical WordPress versioning). The fix implements capability checks requiring manage_options permission before processing wmg_save_provider_config AJAX requests. Until patching, implement compensating controls: (1) Disable user registration in WordPress Settings → General → 'Anyone can register' to prevent attacker creation of Subscriber accounts-NOTE this breaks legitimate user registration workflows. (2) Use a Web Application Firewall (WAF) to block POST requests to /wp-admin/admin-ajax.php with action=wmg_save_provider_config from non-administrator sessions-requires session-aware WAF capable of parsing WordPress authentication cookies. (3) Audit existing SMTP settings in WP Mail Gateway configuration for unauthorized changes and reset to known-good values. (4) Review WordPress user accounts for suspicious Subscriber-level accounts created near the time of potential compromise. Official fix details: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3515205%40wp-mail-gateway&new=3515205%40wp-mail-gateway. Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/c7caf1f4-a8dd-4016-91eb-2adbeed5290a.