The Gravity SMTP plugin for WordPress contains a critical authorization flaw that permits authenticated users to perform unauthorized administrative actions, including plugin uninstallation.

This vulnerability is a missing authorization flaw (CWE-862) caused by the failure to verify user permissions for specific plugin actions. Attackers with subscriber-level access or higher can exploit this to deactivate or uninstall the plugin and delete plugin configurations, with the risk further compounded by a potential Cross-Site Request Forgery vector.

The ability for low-privileged users to uninstall security or utility plugins poses a significant risk to site integrity and operational continuity. With a CVSS score of 7.1, this high-severity vulnerability could lead to unauthorized service disruption and the removal of critical email configuration settings, potentially impacting business communications and security posture.

Immediate Action: Update the Gravity SMTP plugin to version 2.1.5 or later, as provided by the vendor.

Proactive Monitoring: Review audit logs for unexpected plugin deactivation events or unauthorized changes to administrative plugin settings.

Compensating Controls: Ensure that WordPress user registration is restricted or monitored, and utilize a Web Application Firewall (WAF) to block suspicious requests targeting plugin administrative endpoints.

Public Exploit Available: Unknown

Given the high CVSS score and the ease with which low-privileged users can disrupt plugin functionality, organizations should prioritize updating the Gravity SMTP plugin immediately. Failure to apply the available security update leaves the environment susceptible to unauthorized configuration changes and potential service outages.