What the vulnerability does
01Description
The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate all SMTP2GO log records from the database or download a CSV export of all SMTP log data including recipient addresses, sender addresses, message subjects, and API response data.
Explanation of Vulnerability in Simple Terms
02Summary
The SMTP2GO for WordPress plugin through version 1.16.0 does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify email settings or configuration that should be restricted to administrators. The vulnerability requires an active WordPress account but no special interaction from other users.
What an attacker can do
03Attacker Capabilities
Modify email settings or plugin configuration that should be admin-only.
Potential impact on your site
04Site Impact
Unauthorized users can alter how emails are sent from your site, potentially disrupting communications or redirecting messages.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
May 28, 2026
CVE published
May 28, 2026
Record updated
