The WP Mailgun SMTP plugin by inkthemes, up to version 1.0.7, contains a missing authorization vulnerability where certain functions are accessible without proper ACL enforcement. This allows unauthenticated remote attackers to invoke functionality that should be restricted, potentially exposing limited confidential information. The vulnerability does not require privileges or user interaction and has no known active exploitation. No vendor advisory or patch information is currently provided.

The vulnerability permits unauthenticated network attackers to access functionality not properly protected by authorization controls, leading to limited confidentiality impact. There is no impact on integrity or availability. No known exploits have been reported, so the practical risk is currently theoretical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from inkthemes and consider restricting access to the plugin's functionality via other means such as web application firewalls or access control at the server level.