Missing authorization in the Post SMTP plugin allows an attacker to perform actions that should be protected by proper access controls. The vulnerability is classified as CWE‑862, meaning the system fails to enforce required permissions, which could lead to unauthorized configuration changes or exposure of sensitive data within the plugin’s administrative area. The CVSS score of 4.3 indicates a moderate risk level, reflecting the potential for non‑privileged users to gain elevated privileges inside the plugin’s functions.

The affected product is the WordPress Post SMTP plugin developed by Saad Iqbal. Any installation of the plugin at version 2.9.11 or earlier is impacted; earlier undocumented versions up to 2.9.11 are also vulnerable.

The EPSS score of less than 1% demonstrates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, if an attacker gains access to an account that has administrative rights to the plugin or if the site’s lock‑out mechanisms are misconfigured, the missing authorization could be leveraged to alter mail settings, bypass security restrictions, or gather sensitive configuration data. Given the moderate CVSS score and low EPSS, the risk is moderate but not negligible, especially for high‑traffic or mission‑critical sites.