Gravity SMTP Missing Authorization Vulnerability Allowing Uninstallation and Deactivation of the Plugin

A vulnerability exists in the Gravity SMTP plugin for WordPress, in versions through 2.1.4, due to missing authorization checks. This flaw allows authenticated users with subscriber-level access and above to uninstall and deactivate the plugin, as well as delete plugin options. Additionally, this vulnerability can be exploited through Cross-Site Request Forgery (CSRF).

Impact

Exploitation of this vulnerability allows for the unauthorized uninstallation and deactivation of the Gravity SMTP plugin, along with the removal of its options. This could disrupt email delivery services managed by the plugin, potentially leading to missed communications or delivery failures.

Remediation

Users are advised to update the Gravity SMTP plugin to version 2.1.5 or a newer patched version.