The vulnerability is an unauthenticated Cross Site Request Forgery (CSRF) in the WordPress Gmail SMTP plugin versions up to 1.2.3.19. An attacker can trigger plugin operations without authentication by forging a web request, potentially altering SMTP configuration or causing the site to send emails without authorization. This can compromise the integrity of the application and facilitate the delivery of phishing or spam emails. The weakness is classified as CWE‑352.

The affected product is the Gmail SMTP plugin for WordPress developed by Noor Alam. Versions 1.2.3.19 and earlier are vulnerable. No other vendors or products are listed.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score is not available, suggesting limited data on exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a victim who is authenticated to the WordPress site visiting a malicious web page that submits a forged request to the plugin’s endpoint. Successful exploitation would allow an attacker to modify plugin settings or use the site to send unauthorized emails, but would require the victim’s browser to be active and authenticated. Given the lack of a broader exploit or zero‑day status, the overall risk remains moderate but still actionable.