WP Mail Gateway CVE-2026-6963

Requires authenticated WordPress user account with Subscriber-level privileges or higher. WordPress sites with open user registration (Settings → General → 'Anyone can register' enabled) allow attackers to create the required Subscriber account without prior access. Sites with closed registration are vulnerable only if attacker can compromise an existing low-privilege account through credential stuffing, phishing, or other means. The WP Mail Gateway plugin must be installed and active-no special SMTP provider configuration required as the vulnerability exists in the AJAX handler itself, not provider-specific code. Exploitation is NOT limited by network factors: AV:N indicates remote exploitation from any network location. AC:L confirms no special timing, race conditions, or environmental prerequisites. UI:N means no administrator interaction required-attacker-controlled AJAX request alone achieves SMTP reconfiguration. LIMITING FACTOR: Sites without WP Mail Gateway plugin installed are not affected (obviates the vulnerability entirely). Sites with Web Application Firewalls performing WordPress-aware authorization checks may block unauthorized AJAX actions if WAF rules inspect user roles.

Real-world risk is HIGH and actionable despite no confirmed active exploitation. CVSS 8.8 accurately reflects impact: AV:N (network-exploitable against any internet-facing WordPress site), AC:L (low complexity-simple AJAX request), PR:L (requires authenticated account but WordPress subscriber registration is often open), UI:N (no user interaction needed post-authentication). The privilege escalation path is deterministic and fully automated: create subscriber account → modify SMTP settings → trigger password reset for admin → intercept email → compromise admin account. EPSS data not provided, but similar WordPress authentication bypass vulnerabilities typically score 10-30% exploitation probability within 30 days of disclosure. The availability of source code references (WordPress plugin repository trac links showing exact vulnerable lines) significantly lowers exploitation barrier-security researchers and attackers can craft working exploits by examining the changeset diff. Wordfence reporting suggests responsible disclosure occurred, but publicly accessible source code means exploitation window is open until sites patch. CRITICAL GAPS: Patch version number not explicitly stated in references-changeset 3515205 indicates a fix exists but released version number requires verification from WordPress plugin repository. No confirmation whether default WordPress installations are vulnerable or if plugin requires specific SMTP provider configurations.

An external attacker registers a free Subscriber account on a WordPress site running WP Mail Gateway 1.8 or earlier (common when membership features or comment registration are enabled). Using authenticated session credentials, the attacker crafts a POST request to /wp-admin/admin-ajax.php with action=wmg_save_provider_config, modifying SMTP server settings to point to attacker-controlled infrastructure (smtp.attacker.com). The attacker then triggers a password reset for the site administrator account via the standard WordPress login form. The password reset email routes through the malicious SMTP server, where the attacker intercepts the reset token, completes the password reset process, and gains full administrative access to the WordPress site. No exploit code required beyond basic HTTP request manipulation-publicly available source code references provide complete implementation details for exploitation.