What is the CVSS score of CVE-2026-7621?

CVE-2026-7621 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

SMTP2GO WordPress Plugin CVE-2026-7621

EUVD-2026-32735 MEDIUM

Missing Authorization (CWE-862)

2026-05-28 Wordfence

GHSA-j6m5-8x48-22mr

WordPress Authentication Bypass Wordpress Plugin Smtp2Go For Wordpress Email Made Easy Smtp2Go

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:54 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

MEDIUM 4.3

DescriptionCVE.org

The SMTP2GO for WordPress - Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate all SMTP2GO log records from the database or download a CSV export of all SMTP log data including recipient addresses, sender addresses, message subjects, and API response data.

AnalysisAI

Unauthorized access in the SMTP2GO for WordPress plugin (all versions through 1.16.0) allows authenticated attackers holding only subscriber-level accounts to either wipe all SMTP delivery log records from the WordPress database or export a full CSV of those logs - exposing recipient addresses, sender addresses, message subjects, and API response data. The flaw stems from missing authorization checks on administrative actions within the plugin's WordPress admin class (WordpressPluginAdmin.php), meaning low-privileged users can invoke privileged log-management operations without restriction. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the low privilege bar makes this accessible to any registered WordPress user.

Technical ContextAI

The affected component is the SMTP2GO for WordPress - Email Made Easy plugin (CPE: cpe:2.3:a:smtp2go:smtp2go_for_wordpress_-_email_made_easy:*:*:*:*:*:*:*:*), a WordPress plugin that routes outbound email through the SMTP2GO SaaS delivery service and logs delivery metadata locally. The root cause is CWE-862 (Missing Authorization): the plugin registers AJAX handlers or admin-facing action endpoints - visible in WordpressPluginAdmin.php at lines 75 and 85, and WordpressPlugin.php at line 135 - without properly verifying whether the requesting user holds the necessary capability (e.g., manage_options or a comparable administrative role). WordPress's capability system requires explicit checks such as current_user_can() before executing privileged operations; the absence of these checks allows any authenticated user, including subscribers, to trigger log truncation (data destruction) or log export (data disclosure). The WordPress plugin repository changeset 3546743 is referenced as containing remediation.

RemediationAI

The WordPress plugin repository changeset 3546743 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3546743%40smtp2go&new=3546743%40smtp2go) represents the upstream fix commit; however, a specific released patched version number is not independently confirmed from the available data - administrators should check the SMTP2GO plugin page on WordPress.org for the first release after 1.16.0 and update immediately. As a compensating control pending upgrade, site administrators should audit which user roles can register on the site and temporarily restrict new subscriber registrations or elevate the minimum role for untrusted users. Additionally, restricting access to wp-admin and WordPress AJAX endpoints (wp-admin/admin-ajax.php) at the network perimeter or WAF layer for non-administrative roles can reduce exposure, though this may break other plugin functionality. If the SMTP2GO logs contain sensitive operational data, consider rotating API keys referenced in stored log records as a precaution, since those values may have already been exported by a malicious subscriber.