The SMTP2GO WordPress plugin contains a missing authorization flaw that incorrectly allows users to access restricted functions. This weakness can lead to unauthorized disclosure or modification of email settings. The flaw is classified as CWE-862.

The flaw affects all installations of the SMTP2GO plugin for WordPress from the earliest available version up to and including 1.12.1. Site owners must verify the installed plugin version.

The CVSS score of 4.3 signals medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw permits unauthorized access to plugin actions, an attacker could potentially hijack email configurations or exfiltrate data. The likely attack vector is inferred to involve HTTP requests to the plugin’s action URLs, enabled by the absence of proper capability checks; even users lacking administrative rights may be able to trigger these requests if the endpoints are publicly reachable.