CVE-2026-111577: GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

Q: Who can exploit this issue?

A user with a delegated role that has the GoSMTP plugin activation capability, but is below administrator, can access the SMTP configuration page and change outbound mail delivery settings.

Q: What access does an attacker need before exploitation?

The attacker needs an existing WordPress account with the capability to activate the GoSMTP plugin. No administrator role is required if that capability has been delegated to a lower-privileged role.

Q: What is the likely impact of changing the SMTP settings?

An attacker can redirect or control outbound email delivery and use that control to take over an administrator account.

Q: How can administrators determine whether their site is exposed?

Sites using a GoSMTP version before 1.2.5 are affected if a non-administrator role has been delegated the capability to activate the GoSMTP plugin.

Published Oct 28, 2026

Updated

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

Affected Software

1 affected component

GoSMTP GoSMTP WordPress plugin<1.2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GoSMTP WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.2.5

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with a delegated role that has the GoSMTP plugin activation capability, but is below administrator, can access the SMTP configuration page and change outbound mail delivery settings.

What access does an attacker need before exploitation?

The attacker needs an existing WordPress account with the capability to activate the GoSMTP plugin. No administrator role is required if that capability has been delegated to a lower-privileged role.

What is the likely impact of changing the SMTP settings?

An attacker can redirect or control outbound email delivery and use that control to take over an administrator account.

How can administrators determine whether their site is exposed?

Sites using a GoSMTP version before 1.2.5 are affected if a non-administrator role has been delegated the capability to activate the GoSMTP plugin.

CVE-2026-111577: GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need before exploitation?

What is the likely impact of changing the SMTP settings?

How can administrators determine whether their site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need before exploitation?

What is the likely impact of changing the SMTP settings?

How can administrators determine whether their site is exposed?