CVE-2026-6963 in WP Mail Gateway Plugin
Summary
by MITRE • 05/02/2026
The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update SMTP settings and redirect mail which can be used for privilege escalation by triggering a password reset email and using that to access and administrator's account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/11/2026
The WP Mail Gateway plugin for WordPress presents a critical authorization vulnerability that stems from inadequate access control mechanisms within its AJAX handling functionality. This vulnerability exists in all versions up to and including 18 and specifically affects the wmg_save_provider_config AJAX action which lacks proper capability verification. The flaw allows authenticated attackers who possess Subscriber-level permissions or higher to exploit this weakness and manipulate core email configuration settings. The technical implementation fails to validate whether the requesting user possesses sufficient privileges to modify SMTP provider configurations, creating an unauthorized access vector that directly undermines the plugin's security model.
The operational impact of this vulnerability extends beyond simple configuration modification as it enables attackers to redirect email communications through malicious SMTP servers. When an authenticated user with Subscriber privileges can manipulate the email gateway settings, they gain the ability to intercept and redirect important system communications including password reset notifications. This capability creates a direct path for privilege escalation attacks where attackers can trigger password reset emails to be sent to their controlled email addresses, effectively compromising administrator accounts and gaining elevated system access. The vulnerability essentially transforms a low-privilege user account into a potential administrator compromise vector.
This security flaw aligns with CWE-285 which identifies improper authorization as a fundamental weakness in access control systems. The missing capability check represents a classic authorization bypass vulnerability that allows unauthorized modification of system configurations. From an ATT&CK framework perspective, this vulnerability maps to T1078 Valid Accounts and T1566 Phishing, as attackers can leverage compromised user accounts to escalate privileges and gain administrative access through email-based attack vectors. The vulnerability also demonstrates characteristics of T1059 Command and Scripting Interpreter when attackers utilize the compromised email system to execute further malicious activities.
The mitigation strategy should focus on implementing proper capability checks within the AJAX action handler to ensure that only users with appropriate administrative privileges can modify SMTP configurations. Plugin developers should enforce strict authorization controls before processing any configuration changes, particularly those affecting email delivery mechanisms. System administrators should immediately update to patched versions of the WP Mail Gateway plugin and review user permissions to minimize the attack surface. Additionally, monitoring for unauthorized configuration changes and implementing email delivery tracking can help detect exploitation attempts. The vulnerability highlights the critical importance of validating user capabilities for all administrative functions, especially those involving core system communication channels that can be leveraged for privilege escalation attacks.