CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress wp-mail-bank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank - #1 Mail SMTP Plugin for WordPress: from n/a through <= 4.0.14.
Explanation of Vulnerability in Simple Terms
Mail Bank plugin for WordPress versions 4.0.14 and earlier lack proper authorization checks on certain functions. A logged-in user with low privileges can read sensitive email configuration data without needing higher permissions. The vulnerability does not allow modification or deletion of data, only unauthorized viewing of settings.
What an attacker can do
Read email configuration and SMTP settings without proper authorization.
Potential impact on your site
Email credentials and SMTP configuration may be exposed to low-privilege users who should not have access.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
