The v 1.9.0 and earlier release of the SureMail – SMTP and Email Logs Plugin for WordPress allows an attacker to upload any file type because the code that processes attachments does not validate the file extension or content type. The file is stored with a predictable name generated from an MD5 hash in a web‑accessible directory. If the site runs on a server configuration that does not enforce protection of that directory – such as nginx, IIS, Lighttpd, or a misconfigured Apache installation – the attacker can directly access a malicious PHP file and execute arbitrary code, potentially gaining full control of the server. This flaw is documented as CWE‑434.

WordPress sites running the SureMail – SMTP and Email Logs Plugin version 1.9.0 or older, provided by brainstormforce. The vulnerability affects the plugin’s upload handling for email attachments, which stores files in wp‑content/uploads/suremails/attachments/ and relies on an Apache .htaccess rule that does not work on many common server platforms.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests that, as of the latest data, exploitation attempts are expected to be rare. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to submit a file through any public form that sends an email attachment and then calculate the expected MD5 hash to retrieve the file. Successful exploitation requires the target web server to allow PHP execution in the upload directory, which is typical for poorly configured or nginx/IIS/Lighttpd deployments.