The vulnerability is a Cross‑Site Request Forgery (CSRF) condition in the WP Gmail SMTP plugin. An attacker could force an authenticated user to perform configuration changes or send emails without the user’s consent, potentially enabling spam or other unauthorized actions. The weakness is identified by CWE‑352 and can compromise the integrity of site settings.

WordPress sites that have the WP Gmail SMTP plugin version 1.0.7 or earlier installed are affected. Until upgraded to version 1.0.8 or later, all users of these installations remain at risk.

The CVSS score of 4.3 denotes moderate severity, while the EPSS score of less than 1% indicates a low exploitation probability. The vulnerability is not listed in CISA KEV, meaning there is no known exploited instance. The likely attack vector is that a user with administrator privileges is enticed to visit a malicious URL, causing the plugin to process a forged request. Successful exploitation requires an authenticated session with sufficient privileges.