What is the CVSS score of EUVD-2026-39662?

EUVD-2026-39662 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Gmail SMTP EUVD-2026-39662

| CVE-2026-57657 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-26 audit@patchstack.com

GHSA-7h56-5554-rc7g

WordPress CSRF Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Attacker requires no credentials (PR:N); victim's browser interaction is mandatory (UI:R); impact is limited to plugin configuration integrity (I:L), with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:08 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

AnalysisAI

Cross-Site Request Forgery in the Gmail SMTP WordPress plugin (versions up to and including 1.2.3.19) enables a remote unauthenticated attacker to trigger unauthorized state-changing actions on behalf of a logged-in WordPress administrator. The attacker does not need any credentials - only the administrator's authenticated browser session, obtained by luring them to a malicious page. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero-privilege requirement make it straightforward to exploit once a target is identified.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a web application fails to verify that state-changing HTTP requests originate from the legitimate application interface rather than a third-party page. WordPress plugins are expected to protect admin-facing form submissions with nonces via wp_verify_nonce(); the Gmail SMTP plugin (a WordPress plugin that configures outbound email relay through Google's SMTP service) appears to lack this validation in versions up to 1.2.3.19. Because the plugin controls SMTP credentials and routing, a successful CSRF attack can alter the email dispatch configuration - potentially redirecting outbound mail or substituting attacker-controlled relay credentials. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms the network-accessible, low-complexity nature with no privilege requirement on the attacker's side.

RemediationAI

Update the Gmail SMTP WordPress plugin to the first version released after 1.2.3.19 that addresses this issue; the exact fixed version is not independently confirmed from the available data - consult the plugin's WordPress.org changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-19-cross-site-request-forgery-csrf-vulnerability for the confirmed patched release. As a compensating control while awaiting a patch, administrators can deactivate the Gmail SMTP plugin and revert to WordPress's default mail function, though this may disrupt outbound email delivery. Restricting wp-admin access to trusted IP ranges via server-level rules (e.g., Nginx allow/deny directives or .htaccess) reduces the likelihood that a CSRF payload will reach an authenticated admin session. Enforcing strict Content-Security-Policy and SameSite=Strict cookie attributes at the server level further limits CSRF exploitability, though these require web server configuration changes and may affect other plugin functionality.