An authorization bypass vulnerability in the WP Mail Gateway plugin for WordPress allows low-privileged users to redirect mail and achieve privilege escalation.

This is a missing authorization flaw classified under CWE-862, affecting the wmg_save_provider_config AJAX action. The attack requires authenticated access with Subscriber-level privileges or above to execute.

A successful exploit allows attackers with minimal privileges to manipulate SMTP settings, redirect outbound communications, and trigger password reset emails to compromise administrator accounts. This creates severe risks of total system takeover and data compromise. The high CVSS score of 8.8 properly reflects the critical nature of these potential impacts.

Immediate Action: Update the WP Mail Gateway plugin to the latest patched version once available, or deactivate the plugin immediately if no update exists.

Proactive Monitoring: Monitor authentication logs and user account modification records for suspicious administrative role assignments or password resets.

Compensating Controls: Implement Web Application Firewall rules to block unauthorized requests targeting the wmg_save_provider_config AJAX endpoint.

Public Exploit Available: No

Security teams must treat this authorization flaw with high priority given its potential to facilitate complete administrative takeover. Apply the vendor update immediately or remove the plugin from production environments until a secure version is deployed.