Live › vulnerability › CVE-2026-111577
Go to dashboardThe GoSMTP WordPress plugin before 1.2.5 does not check authorization on its SMTP settings page, so users with a delegated role below administrator can change outbound mail delivery. The description states this leads to administrator account takeover.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
WordPress sites running the GoSMTP plugin before 1.2.5, especially those that delegate capabilities to non-administrator roles. Sites without GoSMTP installed, or running a patched version, are not affected. The sources do not say whether default role setups are exposed.
No product ranges from the sources yet.
wp plugin get gosmtp --field=version1.2.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
This page as .md · .json · in your agent: get_signal("CVE-2026-111577")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.