PT-2026-127836
CVE-2026-111577
·
Published
2026-10-28
·
Updated
2026-10-28
Description by
CVSS 3.1
7.2
HighMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾