Junglewise Threat Intelligence

CVE-2026-7621: SMTP2GO WordPress Plugin unauthorized access in email logs

CVE-2026-7621 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Executive brief

The SMTP2GO plugin for WordPress, which manages email delivery for websites, contains a security flaw that allows low-level users to access sensitive email logs. An attacker with a basic account on the site could download a list of all sent emails, including recipient addresses and subjects, or delete the site's email history. This could lead to the exposure of private communication details and the loss of administrative audit trails.

Technical details

The SMTP2GO for WordPress plugin (versions up to 1.16.0) suffers from a missing authorization check (CWE-862) in its administrative functions. The plugin fails to properly verify user permissions before allowing access to log management features. This vulnerability allows an authenticated attacker with minimal privileges (such as a Subscriber) to perform actions typically reserved for administrators. Specifically, an attacker can trigger a CSV export of all SMTP log data—exposing recipient/sender addresses, message subjects, and API responses—or truncate the SMTP2GO log table entirely, leading to data loss and loss of audit integrity.

Affected products

  • SMTP2GO SMTP2GO for WordPress – Email Made Easy Up to and including 1.16.0

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References