CVE-2026-111577 in GoSMTP Plugin
Summary
by MITRE • 10/28/2026
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of the GoSMTP WordPress plugin prior to release 1.2.5 represents a critical failure in access control mechanisms within the application's administrative interface. Specifically, the SMTP configuration page lacks proper authorization checks for modifying settings. While the plugin correctly restricts general activation capabilities based on user roles, it fails to enforce role-based access controls when handling requests that alter mail delivery configurations. This architectural oversight allows any authenticated user with a delegated role below administrator, such as subscriber or contributor levels in standard WordPress installations, to interact directly with the SMTP configuration endpoints without possessing the requisite administrative privileges.
From a technical perspective, this flaw constitutes an insecure direct object reference combined with broken access control logic. The application relies solely on the capability required to activate the plugin rather than verifying that the current user has permission to modify system-wide settings like email server credentials and routing rules. By manipulating HTTP requests to update SMTP parameters such as host, port, authentication tokens, or encryption methods, an attacker can redirect outbound mail traffic through a malicious relay they control. This misconfiguration effectively bypasses the intended security boundary between low-privilege users and high-privilege administrative functions, creating a pathway for significant data exfiltration and further system compromise.
The operational impact of this vulnerability is severe due to its potential to facilitate account takeover via email reset mechanisms. Most WordPress installations rely on password reset functionality that sends recovery links or codes to the administrator's registered email address. By controlling the SMTP configuration, an attacker can intercept these critical authentication tokens sent by the platform. Once the attacker obtains the password reset link for a high-privilege account, they can easily change the admin credentials and gain full control over the WordPress installation. This chain of exploitation transforms a seemingly minor misconfiguration into a complete compromise of the web application's integrity and confidentiality.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor obtaining privileges that they are not explicitly granted by the system design. Furthermore, in the context of the MITRE ATT&CK framework for enterprise security, this behavior maps to T1078 Valid Accounts and potentially T1534 Internal Spearphishing if used within a broader attack chain involving lateral movement or data theft through compromised email channels. The lack of server-side validation on role permissions is a classic example of relying on client-side assumptions or incomplete backend checks for security enforcement.
To mitigate this risk, administrators must immediately upgrade the GoSMTP plugin to version 1.2.5 or later, where these authorization gaps have been addressed by implementing strict capability checks before processing any changes to SMTP settings. Until an update is applied, it is advisable to restrict access to all WordPress admin pages using web application firewall rules that limit administrative endpoints to known IP addresses or require multi-factor authentication for all user roles. Additionally, organizations should audit their plugin ecosystem regularly to ensure that no other components suffer from similar privilege escalation flaws, as maintaining the principle of least privilege across all integrated services is essential for robust defense-in-depth strategies against unauthorized access and data breaches.