{"id":"CVE-2026-111577","kind":"vulnerability","aliases":["CVE-2026-111577"],"related":[],"title":"GoSMTP WordPress plugin: low-role users can change mail settings and take over admin","description":"The GoSMTP  WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP  WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.","summary":"The GoSMTP WordPress plugin before 1.2.5 does not check authorization on its SMTP settings page, so users with a delegated role below administrator can change outbound mail delivery. The description states this leads to administrator account takeover.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gosmtp","package","wordpress","wordpress-plugin"],"not_affected_if":["gosmtp-not-installed","plugin-version-1.2.5-or-later"],"how_to_check":"- Check the installed GoSMTP version in the WordPress Plugins screen or `wp plugin get gosmtp --field=version`\n- Review which users hold roles below administrator that were given access to plugin settings\n- unknown for other checks, as the sources do not say","fix":"- Update the GoSMTP plugin to `1.2.5` or later\n- unknown for other actions, as the sources do not say","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:34+00:00","updated_at":"2026-10-28T06:32:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GoSMTP plugin to `1.2.5` or later\n- unknown for other actions, as the sources do not say","reach":"internet","title":"GoSMTP WordPress plugin: low-role users can change mail settings and take over admin","impact":"high","summary":"The GoSMTP WordPress plugin before 1.2.5 does not check authorization on its SMTP settings page, so users with a delegated role below administrator can change outbound mail delivery. The description states this leads to administrator account takeover.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","gosmtp"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privilege account takes over the WordPress administrator account","analyst_note":"Confirm the affected version range and whether default roles can reach the settings page; source is NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-111577.","how_to_check":"- Check the installed GoSMTP version in the WordPress Plugins screen or `wp plugin get gosmtp --field=version`\n- Review which users hold roles below administrator that were given access to plugin settings\n- unknown for other checks, as the sources do not say","needs_analyst":true,"not_affected_if":["plugin-version-1.2.5-or-later","gosmtp-not-installed"],"who_is_affected":"WordPress sites running the GoSMTP plugin before `1.2.5`, especially those that delegate capabilities to non-administrator roles. Sites without GoSMTP installed, or running a patched version, are not affected. The sources do not say whether default role setups are exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3331,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111577':18A,21A '-2026':17A,20A '1.2.5':33B,70C,95C 'account':63B,114C 'achiev':112C 'activ':96C 'admin':15A 'administr':50B,62B,105C,113C 'allow':98C 'author':37B,78C 'capabl':97C 'chang':9A,52B,107C 'check':36B,79C 'configur':83C 'cve':16A,19A 'deleg':47B,102C 'deliveri':55B,110C 'descript':57B 'gate':87C 'gosmtp':1A,22B,29B,66C,91C 'lead':60B 'low':5A 'low-rol':4A 'mail':10A,54B,109C 'manag':77C 'outbound':53B,108C 'packag':23B 'page':42B,84C 'perform':73C 'plugin':3A,27B,31B,68C,93C 'role':6A,48B,103C 'set':11A,41B,76C 'settings-manag':75C 'smtp':40B,82C 'state':58B 'take':13A 'takeov':64B,115C 'user':7A,44B,99C 'wordpress':2A,24B,26B,30B,67C,92C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the GoSMTP plugin before `1.2.5`, especially those that delegate capabilities to non-administrator roles. Sites without GoSMTP installed, or running a patched version, are not affected. The sources do not say whether default role setups are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111577","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}