{"id":"CVE-2026-124267","kind":"vulnerability","aliases":["CVE-2026-124267"],"related":[],"title":"Gmail SMTP WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.","summary":"The Gmail SMTP plugin by Noor Alam fails to check authorization properly, so access control settings can be bypassed. An attacker who can reach the plugin's functions can get access they should not have.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gmail-smtp","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Gmail SMTP (gmail-smtp) in the WordPress plugins list or the plugin's readme.txt\n- Confirm whether the installed version is `1.2.3.23` or earlier","fix":"- Gmail SMTP (gmail-smtp): move to a version later than `1.2.3.23`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:24+00:00","updated_at":"2026-11-13T15:48:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:24Z","model":"claude-haiku-5-5","output":{"fix":"- Gmail SMTP (gmail-smtp): move to a version later than `1.2.3.23`; the sources do not name the exact fixed version","reach":"internet","title":"Gmail SMTP WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"The Gmail SMTP plugin by Noor Alam fails to check authorization properly, so access control settings can be bypassed. An attacker who can reach the plugin's functions can get access they should not have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gmail-smtp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users change access-controlled plugin behavior or settings","analyst_note":"Confirm the fixed version and the required privilege from the NVD entry or the WordPress plugin changelog for gmail-smtp.","how_to_check":"- Check the installed version of Gmail SMTP (gmail-smtp) in the WordPress plugins list or the plugin's readme.txt\n- Confirm whether the installed version is `1.2.3.23` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Gmail SMTP plugin version 1.2.3.23 or earlier are affected. The sources do not say which roles or settings are required to exploit the flaw, so treat any site with the plugin installed as exposed until checked.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4554,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124267':14A,17A '-2026':13A,16A '1.2.3.23':80C 'access':10A,36B,53B,69C 'affect':74C 'alam':29B,59C 'allow':65C 'attack':43B 'author':6A,33B,55C 'bypass':9A,41B 'check':32B 'configur':68C 'control':11A,37B,70C 'cve':12A,15A 'exploit':66C 'fail':30B 'function':50B 'get':52B 'gmail':1A,19B,24B,60C,63C,75C 'gmail-smtp':18B,62C 'incorrect':67C 'issu':73C 'let':7A 'levels.this':72C 'miss':5A,54C 'n/a':78C 'noor':28B,58C 'packag':21B 'plugin':4A,26B,48B 'proper':34B 'reach':46B 'secur':71C 'set':38B 'smtp':2A,20B,25B,61C,64C,76C 'user':8A 'vulner':56C 'wordpress':3A,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gmail SMTP plugin version 1.2.3.23 or earlier are affected. The sources do not say which roles or settings are required to exploit the flaw, so treat any site with the plugin installed as exposed until checked.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gmailsmtp","high","package","wordpress"],"campaign_type":null,"search_a":"'-124267':14A,17A '-2026':13A,16A 'access':10A 'author':6A 'bypass':9A 'control':11A 'cve':12A,15A 'gmail':1A 'let':7A 'miss':5A 'plugin':4A 'smtp':2A 'user':8A 'wordpress':3A","search_b":"'access':36B,53B 'alam':29B 'attack':43B 'author':33B 'bypass':41B 'check':32B 'control':37B 'fail':30B 'function':50B 'get':52B 'gmail':19B,24B 'gmail-smtp':18B 'noor':28B 'packag':21B 'plugin':26B,48B 'proper':34B 'reach':46B 'set':38B 'smtp':20B,25B 'wordpress':22B","search_c":"'1.2.3.23':80C 'access':69C 'affect':74C 'alam':59C 'allow':65C 'author':55C 'configur':68C 'control':70C 'exploit':66C 'gmail':60C,63C,75C 'gmail-smtp':62C 'incorrect':67C 'issu':73C 'levels.this':72C 'miss':54C 'n/a':78C 'noor':58C 'secur':71C 'smtp':61C,64C,76C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124267","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}