The WP Mail Gateway WordPress plugin is vulnerable due to a missing capability check on the wmg_save_provider_config AJAX action in all releases up to version 1.8. This flaw allows an authenticated user with Subscriber-level access or higher to alter the plugin’s SMTP settings. By changing these settings, the attacker can redirect outgoing emails, such as password reset notices, to capture credentials and thereby gain administrative access to the site. The vulnerability is a missing authorization flaw (CWE‑862) that can be used for privilege escalation.

WordPress sites running the WP Mail Gateway plugin, versions up to and including 1.8, are impacted. Users of the plugin should verify the current version and consider updating to the latest release that addresses the authorization check.

The CVSS score is 8.8, indicating high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to be authenticated, but only a subscriber or higher role is required, suggesting the exploit vector is via normal authenticated access to the WordPress site. The lack of a capability check makes the exploitation straightforward for any user who can log in to the dashboard or access the AJAX endpoint.