CVE-2026-7621: SMTP2GO WordPress Auth Bypass Vulnerability

CVE-2026-7621 Overview

CVE-2026-7621 is a missing authorization vulnerability [CWE-862] in the SMTP2GO for WordPress – Email Made Easy plugin. The flaw affects all versions up to and including 1.16.0. The plugin fails to verify whether a user is authorized to perform privileged actions on SMTP log data. Authenticated attackers holding subscriber-level access or above can truncate all SMTP2GO log records or download a CSV export containing recipient addresses, sender addresses, message subjects, and API response data. The issue results from missing capability checks on log management endpoints exposed through the plugin's administrative interface.

Critical Impact

Any authenticated user with subscriber privileges can exfiltrate sensitive email metadata or wipe SMTP audit logs, undermining email accountability and privacy.

Affected Products

• SMTP2GO for WordPress – Email Made Easy plugin versions through 1.16.0
• WordPress sites running the SMTP2GO integration plugin
• Any environment relying on SMTP2GO log retention for compliance or auditing

Discovery Timeline

• 2026-05-28 - CVE-2026-7621 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-7621

Vulnerability Analysis

The SMTP2GO plugin registers handlers for managing the plugin's SMTP log records. These handlers do not enforce a capability check, such as current_user_can('manage_options'), before executing privileged actions. As a result, any authenticated session, including the lowest-privileged subscriber role, can invoke the log truncation and CSV export functions.

Two distinct actions are exposed by the missing authorization flaw. The first allows an attacker to truncate all SMTP2GO log records from the database, destroying forensic and operational evidence. The second exports the full SMTP log dataset as a CSV file, exposing message metadata that may include personally identifiable information.

Registered users on sites that allow open registration, common on WooCommerce, membership, and community sites, are sufficient to exploit this issue. Confidentiality impact is rated low because only metadata, not full message bodies, is exposed, but the integrity impact on audit logs is meaningful.

Root Cause

The root cause is a missing authorization check [CWE-862]. The affected handlers, referenced in WordpressPlugin.php and WordpressPluginAdmin.php in the plugin source, route AJAX or admin-post requests directly to log management functions without verifying user capabilities. Nonce validation alone, where present, only protects against cross-site request forgery and does not enforce role-based authorization.

Attack Vector

Exploitation requires the attacker to hold valid credentials at the subscriber level or above. The attacker submits a crafted request to the plugin's log-handling endpoint while authenticated. No user interaction beyond the attacker's own session is required, and the attack is delivered over the network against the WordPress admin or AJAX surface.

The vulnerability mechanism is described in prose because no verified exploit code has been published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-7621

Indicators of Compromise

• Unexpected CSV downloads originating from the WordPress admin or AJAX endpoints associated with the smtp2go plugin.
• Sudden truncation or disappearance of SMTP2GO log records without an administrator-initiated action.
• HTTP requests to plugin endpoints carrying authenticated session cookies for non-administrative users such as subscribers or customers.

Detection Strategies

• Review web server access logs for POST or GET requests to plugin handler URLs paired with low-privilege user sessions.
• Correlate log-truncation events in WordPress with the originating user ID and role to flag activity by non-admin accounts.
• Monitor file system or download logs for CSV exports generated outside of expected administrative workflows.

Monitoring Recommendations

• Enable verbose request logging for the wp-admin/admin-ajax.php and admin-post.php endpoints used by the SMTP2GO plugin.
• Alert on any HTTP request to plugin endpoints where the authenticated user's role is below administrator.
• Track the row count of the SMTP2GO log table and alert on unexpected drops to zero.

How to Mitigate CVE-2026-7621

Immediate Actions Required

• Update the SMTP2GO for WordPress – Email Made Easy plugin to a version newer than 1.16.0 once the vendor publishes a patched release.
• Audit existing WordPress user accounts and remove or downgrade any unnecessary subscriber-level accounts on sites with open registration.
• Export and securely archive existing SMTP2GO logs before applying remediation to preserve any forensic evidence.

Patch Information

The vendor changeset is tracked in the WordPress Plugin Changeset. Administrators should install the fixed version through the WordPress plugin updater. Review the Wordfence Vulnerability Report for the confirmed patched version once available.

Workarounds

• Temporarily disable open user registration in WordPress settings to limit the attacker pool.
• Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule.
• Deactivate the SMTP2GO plugin until the patched version is installed if log integrity is a compliance requirement.