The vulnerability in the Post SMTP WordPress plugin is caused by a missing capability check in the update_post_smtp_pro_option_callback function. This flaw allows any authenticated user who has Subscriber-level access or higher to modify plugin settings and enable paid (pro) extensions. The impact is an unauthorized change of configuration, effectively giving attackers the ability to activate commercial features without proper authorization.

The issue exists in all versions of the Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin up to and including version 3.4.1, which is distributed by the saadiqbal vendor on the WordPress Plugin Repository.

The CVSS score of 4.3 indicates a moderate severity, but the vulnerability can be exploited by any authenticated user with Subscriber or higher role, a fairly common access level in WordPress sites. The very low EPSS score (< 1%) suggests that exploitation likelihood is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the attack does not require remote code execution or special network access, administrators should deploy a patch promptly to prevent unauthorized configuration changes.