The plugin contains a missing authorization check (CWE‑862) in the handle_gmail_oauth_redirect function, allowing any authenticated user with a subscriber role or higher to submit arbitrary OAuth credentials. The likely attack vector is an authenticated user leveraging their legitimate login to send crafted OAuth requests. This flaw can enable the attacker to inject malicious or expired tokens, granting unauthorized control over the SMTP service, which could be abused to send spam, phishing emails, or exfiltrate data.

All WordPress installations that have the Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin from Saadiqbal, versions 3.6.1 and earlier. The vulnerability is limited to the plugin’s OAuth authorization handling and does not affect other components of WordPress or the host server.

The CVSS score of 5.4 classifies the issue as moderate severity. The EPSS score of less than 1 % indicates a very low exploitation probability, and the flaw is not currently listed in CISA’s KEV catalog. Exploitation requires a logged‑in user with subscriber‑level privileges, which limits the attack surface. Nonetheless, the ability to manipulate OAuth credentials presents a moderate risk to confidentiality and integrity of email communications. Patch deployment remains the recommended action.