The Bit SMTP plugin for WordPress contains an incorrect privilege assignment flaw (CWE‑266). This vulnerability permits an attacker who gains any level of access to the WordPress site to elevate privileges beyond those originally granted. The attacker could then modify site configuration, view restricted content, or execute arbitrary code, effectively taking full control of the WordPress environment.

Bit Apps Bit SMTP plugin for WordPress is the affected product. All installations running version 1.2.2 or earlier are vulnerable. No further version details are specified.

The CVSS score of 9.0 indicates a high severity impact, while the EPSS score below 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description it is inferred that an attacker would need some access to a WordPress instance and to the plugin’s administrative interface; once authenticated, the misassigned privilege can be leveraged to elevate to administrator rights. The likely attack vector is remote privilege escalation via the plugin interface, with minimal prerequisites beyond possession of a legitimate WordPress account or the ability to interact with the site.