CVE-2026-6963: WordPress WP Mail Gateway Plugin Allows Privilege Escalation

The WP Mail Gateway plugin for WordPress, in all versions up to and including 1.8, is vulnerable to unauthorized access, as reported by the National Vulnerability Database. The flaw, identified as CVE-2026-6963, stems from a missing capability check on the wmg_save_provider_config AJAX action. This oversight enables authenticated attackers with even Subscriber-level access to manipulate SMTP settings.

This isn’t just a configuration tweak; it’s a critical privilege escalation vector. By redirecting mail, an attacker can trigger password reset emails for administrative accounts, capture them, and subsequently gain full control. The National Vulnerability Database has assigned a CVSS score of 8.8 (HIGH) to this vulnerability, underscoring its severe impact on confidentiality, integrity, and availability.

Defenders need to treat this with urgency. A high-severity vulnerability that allows low-privileged users to hijack administrator accounts is a clear and present danger. It bypasses conventional access controls and directly targets the most critical user roles in a WordPress environment. The attacker’s calculus here is simple: find a WordPress site using this plugin, get a basic user account, and then elevate to admin with minimal effort.