The Gravity SMTP plugin fails to perform proper authorization checks for uninstall and deactivate actions. As a result, any authenticated user with the subscriber role or higher can remove the plugin, disable its email sending capability, and delete its stored options. The same flaw allows an attacker to trigger the action via a Cross‑Site Request Forgery vector, potentially without direct interaction with the victim's browser if a malicious link is visited while the user is logged in.

WordPress sites that have the RocketGenius Gravity SMTP plugin installed in versions 2.1.4 or earlier are vulnerable. Sites running later releases, such as 2.1.5 and above, are not affected.

The base CVSS score of 7.1 indicates a medium‑to‑high severity vulnerability. An EPSS score is not provided, and the issue is not catalogued by CISA’s KEV list. An attacker can exploit the flaw by logging in with a subscriber or higher account or by sending a crafted CSRF request to a victim who is authenticated. The impact is site‑wide loss of outbound email capability and potential loss of configuration settings, affecting the confidentiality and availability of email communications.