CVE-2019-25141 CRITICAL

CVE-2019-25141: Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

Vendor Smub
Product Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more
Weakness CWE-862 · Missing authorization
Published June 7, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.

Key dates

02Disclosure timeline

June 7, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32233 WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability CVE-2026-24586 WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability CVE-2022-41619 WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access Control CVE-2024-34691 Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) CVE-2023-47761 WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability