Missing Authorization in the WPExperts Post SMTP plugin allows an attacker to change critical email configuration settings without proper access controls. This flaw is identified as CWE-862, meaning legitimate users can modify configuration values that should be restricted. The vulnerability enables an attacker to alter outgoing mail behavior, potentially redirecting email traffic, injecting malicious content, or compromising business communications. The impact includes loss of data integrity and compromise of email delivery, and can support further phishing or spam campaigns.

Affected systems include the WordPress Post SMTP plugin from versions 4.0.0 through 4.0.0-beta.1. The issue is tied to the WPExperts:Post SMTP product line and affects all installations that have not upgraded beyond the beta.1 release.

The CVSS score of 5.4 indicates a moderate severity, and the lack of an EPSS score suggests limited public exploitation data. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the WordPress administrative interface, where an authenticated user with any role that gains access to the Post SMTP settings can exploit the missing authorization. External attackers would need valid credentials or local access to the host to influence the configuration.