Authorization Flaw in GoSMTP Plugin for WordPress
CVE-2026-111577
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111577?
The GoSMTP WordPress plugin versions prior to 1.2.5 contains a significant authorization flaw that fails to verify settings management on its SMTP configuration page. This loophole allows users with roles below the administrator level to manipulate outbound mail delivery settings without proper permissions. Consequently, this could lead to unauthorized changes, including potential account takeover of administrator privileges, posing a severe security risk to websites using this plugin.
Affected Version(s)
GoSMTP 0 < 1.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.