WordPress Plugin Vulnerabilities

GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

Description

The plugin does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the plugin-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

Proof of Concept

Affects Plugins

Plugin icon
gosmtp
Fixed in 1.2.5

References

CVE
CVE-2026-111577

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
8a20e9fd-9ed8-4984-b34a-2b29b4c8b133

Timeline

Publicly Published
2026-10-26 (about 2 days ago)
Added
2026-10-26 (about 1 day ago)
Last Updated
2026-10-26 (about 1 day ago)

Other

Published
Title
Published
2020-03-25
Title
All-in-One WP Migration < 7.15 - Arbitrary Backup Download
Published
2026-07-23
Title
WPify Woo < 5.4.17 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Published
2026-09-11
Title
User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
Published
2026-08-05
Title
Order Delivery Date for WooCommerce < 4.6.1 - Shop Manager+ Privilege Escalation
Published
2024-05-23
Title
Pie Register - Social Sites Login (Add on) < 1.7.8 - Unauthenticated Privilege Escalation