---
id: "CVE-2026-124267"
page: "https://infrastack.ai/live/CVE-2026-124267"
kind: "vulnerability"
aliases: ["CVE-2026-124267"]
title: "Gmail SMTP WordPress plugin: missing authorization lets users bypass access controls"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gmail-smtp", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:36+00:00"
first_seen_at: "2026-11-13T15:46:16+00:00"
updated_at: "2026-11-13T15:48:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124267", "first_seen_at": "2026-11-13T15:46:16+00:00"}]
exploit_sources: []
---

# Gmail SMTP WordPress plugin: missing authorization lets users bypass access controls

Link for people: https://infrastack.ai/live/CVE-2026-124267 (this .md is for agents)

The Gmail SMTP plugin by Noor Alam fails to check authorization properly, so access control settings can be bypassed. An attacker who can reach the plugin's functions can get access they should not have.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Gmail SMTP (gmail-smtp) in the WordPress plugins list or the plugin's readme.txt
- Confirm whether the installed version is `1.2.3.23` or earlier

## Fix

- Gmail SMTP (gmail-smtp): move to a version later than `1.2.3.23`; the sources do not name the exact fixed version

## Timeline

- 2026-11-13T15:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124267

## From the sources

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_