CVE-2024-6694 affects the WP Mail SMTP plugin by WPForms, where the SMTP password is displayed in plain text within the plugin's settings page for all versions up to 4.0.1. This allows any authenticated user with administrative-level access or higher to retrieve the SMTP password. The vulnerability is categorized under CWE-257, indicating improper storage or exposure of passwords in a recoverable format. The issue does not affect users without high privileges and does not impact confidentiality beyond the SMTP password exposure. There are no known exploits in the wild, and the CVSS v3.1 base score is 2.7, indicating low severity.

An attacker who has already obtained administrative-level access to a WordPress site with the vulnerable plugin can view the SMTP password in plain text. This could potentially allow further misuse of the SMTP credentials if the attacker leverages them outside the WordPress environment. However, since administrative access is required to exploit this vulnerability, the impact is limited to scenarios where the attacker already has significant control over the site.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for any unauthorized access. Consider removing or disabling the plugin if SMTP password exposure is a concern. Follow up with the vendor or WPForms for updates regarding a security patch.