CVE-2026-6963:

CVE-2026-6963 is a missing capability check vulnerability in the WP Mail Gateway plugin for WordPress (versions up to and including 1.8) that allows authenticated attackers with Subscriber-level access to modify SMTP settings and escalate privileges to administrator.

CVE-2026-6963 affects the WP Mail Gateway WordPress plugin in all versions up to and including 1.8. The vulnerability stems from a missing authorization (capability) check on the `wmg_save_provider_config` AJAX endpoint, classified under CWE-862 (Missing Authorization). An authenticated attacker with as little as Subscriber-level access can exploit this flaw to silently reconfigure the site's SMTP mail settings, rerouting all outgoing emails—including password reset notifications—to an address under the attacker's control. This creates a straightforward privilege escalation path: the attacker triggers a password reset for a WordPress administrator, receives the reset link via the hijacked mail route, and then assumes full administrative control of the site. The issue is confirmed exploitable remotely over the network with low complexity and no interaction required from other users.