CVE-2026-6963: WP Mail Gateway Privilege Escalation Flaw

CVE-2026-6963 Overview

CVE-2026-6963 is a missing authorization vulnerability [CWE-862] in the WP Mail Gateway plugin for WordPress, affecting all versions up to and including 1.8. The flaw resides in the wmg_save_provider_config AJAX action, which lacks a capability check. Authenticated users with Subscriber-level access or higher can modify SMTP provider settings and redirect outbound mail traffic. Attackers leverage this to capture password reset emails for administrator accounts, achieving full site takeover. The Wordfence threat intelligence team published the advisory tracking this issue.

Critical Impact

A low-privileged Subscriber account can hijack the WordPress mail pipeline, intercept administrator password reset emails, and escalate to full administrative control of the site.

Affected Products

• WP Mail Gateway plugin for WordPress, all versions through 1.8
• WordPress sites permitting Subscriber-level (or higher) account registration
• Any WordPress deployment with the vulnerable plugin active

Discovery Timeline

• 2026-05-02 - CVE-2026-6963 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6963

Vulnerability Analysis

The WP Mail Gateway plugin registers an AJAX endpoint named wmg_save_provider_config to persist SMTP provider configuration. The handler is wired through the WordPress AJAX framework but does not enforce a current_user_can() capability check before writing the submitted configuration. As a result, any authenticated request, including those originating from Subscriber accounts, is accepted and processed.

Because the handler accepts arbitrary SMTP host, port, credential, and sender values, an attacker can repoint outbound mail to an attacker-controlled relay. Once mail is redirected, the attacker triggers the standard WordPress password reset flow for an administrator account. The reset link is delivered to the attacker's relay, allowing the attacker to set a new password and authenticate as an administrator. This sequence converts unauthorized configuration write access into full account takeover.

Root Cause

The root cause is a missing authorization check on a privileged AJAX action. The wmg_save_provider_config callback, referenced in src/Bootstrap.php and src/Functions.php of the plugin source, registers the action for both wp_ajax_ and authenticated contexts without restricting it to administrators. WordPress treats any logged-in user as eligible to invoke wp_ajax_ hooks unless the handler explicitly verifies capabilities, which this handler does not.

Attack Vector

Exploitation requires only an authenticated session at Subscriber level, a role often granted automatically when registration is enabled. The attacker submits a POST request to /wp-admin/admin-ajax.php with action=wmg_save_provider_config and SMTP parameters pointing to a host they control. After confirming the new mail route, the attacker visits the WordPress login page, requests a password reset for a known administrator username, and harvests the reset token from inbound mail on the rogue SMTP relay. The token grants password reset capability and, subsequently, administrator login.

No verified public exploit code is available at the time of publication. Technical details on the vulnerable handler can be reviewed in the WP Mail Gateway Bootstrap.php source and Functions.php source.

Detection Methods for CVE-2026-6963

Indicators of Compromise

• Unexpected modifications to WP Mail Gateway provider settings stored in the wp_options table, particularly SMTP host, username, or sender address values pointing to unfamiliar domains
• Outbound mail being relayed through hosts not previously authorized by the site administrator
• Successful administrator password resets that were not initiated by legitimate personnel
• New or recently active Subscriber accounts issuing POST requests to admin-ajax.php with action=wmg_save_provider_config

Detection Strategies

• Inspect web server access logs for POST requests to /wp-admin/admin-ajax.php containing the wmg_save_provider_config action originating from low-privileged user sessions
• Compare current SMTP configuration against a known-good baseline and alert on deviations
• Correlate password reset events for administrator accounts against the source IP addresses of preceding AJAX configuration changes

Monitoring Recommendations

• Enable WordPress audit logging for option changes, plugin settings updates, and password reset workflows
• Forward WordPress and PHP-FPM logs to a centralized SIEM for correlation across authentication, configuration, and mail delivery events
• Alert on creation or repeated login activity from Subscriber-level accounts immediately followed by administrative password resets

How to Mitigate CVE-2026-6963

Immediate Actions Required

• Update the WP Mail Gateway plugin to a version newer than 1.8 once the vendor publishes a fix
• If no patched version is available, deactivate and remove the plugin until a fix is released
• Audit administrator accounts for unauthorized password resets and rotate credentials for all privileged users
• Review and restore SMTP provider configuration to a verified, legitimate state

Patch Information

A vendor changeset is referenced in the plugin repository at the WP Mail Gateway changeset 3515205. Administrators should consult the Wordfence vulnerability report for the patched version number and verify that the deployed plugin is updated accordingly.

Workarounds

• Disable open user registration, or restrict the default role to one that cannot authenticate to AJAX endpoints
• Use a web application firewall rule to block requests to admin-ajax.php with action=wmg_save_provider_config unless the user has the manage_options capability
• Restrict outbound SMTP traffic from the WordPress host to a known set of approved mail relays at the network level
• Enforce two-factor authentication on all administrator accounts so that intercepted password reset emails alone cannot grant access

# Configuration example: disable user registration and restrict admin-ajax exposure
wp option update users_can_register 0
wp option update default_role subscriber

# Example nginx rule to block the vulnerable AJAX action at the edge
# location = /wp-admin/admin-ajax.php {
#     if ($request_body ~* "action=wmg_save_provider_config") {
#         return 403;
#     }
# }