The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to craft a request that the victim’s browser will submit to the Mail Baby SMTP plugin as if performed by a legitimate user. The flaw arises because the plugin does not verify the identity or intent of the request source, permitting unauthorized operations e.g., sending emails or modifying configuration. The weakness is identified as CWE‑352.

The flaw affects the InterServer Mail Baby SMTP WordPress plugin through version 2.8 inclusive. Any WordPress installation that has this plugin installed and a user with sufficient privileges could be impacted, regardless of the host environment.

With a CVSS score of 4.3 the severity is moderate; the EPSS score of less than 1 % indicates a low probability of currently observed exploitation. The vulnerability is not listed in CISA’s KEV catalog. Inferred attack vectors involve a malicious site tricking a legitimate user into visiting a crafted page or link that triggers the vulnerable action. No advanced prerequisites are noted, but the attack requires the victim to be authenticated to the WordPress site and to possess a role that can access the plugin’s functionality.